{ "Event": { "published": true, "date": "2021-06-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-21", "timestamp": 1624320181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "125cfb05-77c7-44e1-b838-a72c9f56ad1a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c725bea5-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624259007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259007, "uuid": "17ade5cc-1ec8-4f69-8b12-686ca91e2876", "comment": "Malware payload", "value": "5bda03599e20fd2226c14ad3f22a518b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259007, "uuid": "2d78f4a8-f638-46e8-b37b-fe44ab4312a9", "comment": "Malware payload", "value": "002f47bb6e9157769a3ff8aba74cbb9cc764390da8c07f0f5cbc22e8b3d3106f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259007, "uuid": "d63637d3-e60b-416d-aaee-90334b8a8b8b", "comment": "Malware payload", "value": "887f36bc21fa6ba4d59c418405a3b12f3996300b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259007, "uuid": "ad4ef849-5777-4857-931a-4abf88e02657", "comment": "Malware payload", "value": "e1c2354fa612302bedbbca0dfa5585dfb125676940ae2e16918c1739fa419c132637b4f8357a6ca65404ef671ee20097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259007, "uuid": "3c0cee94-a56c-455e-810a-4f2b04883363", "value": "9366335539F086BEE1610030ACF63D85B335DD184EB4E5632B2D163F9F7C9893A3A52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259007, "uuid": "24f1c742-3777-4879-ae45-57fa8120799e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259007, "uuid": "04d723cc-cc4b-4900-a8ac-c289a886b85f", "value": "98304:c1OBSfk8bUKAB/mHhqUQ5MJmtGBRUMXMyZHG+r8wSKcwqMhBSFa:c1OBMk8FAfNmXxBZmbx9wqMKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259007, "uuid": "4acc3151-6862-45e8-9d41-eba1573d1061", "value": 6518984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259007, "uuid": "01670f0c-09ee-4040-ae5d-706abed0fe02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259007, "uuid": "83b4cefb-7b1b-41a1-a922-1b78f54fcdc1", "value": "5bda03599e20fd2226c14ad3f22a518b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76142b8e-d232-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624239973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239973, "uuid": "95cb2a88-4879-46ad-9c2f-d4ccf1af77bd", "comment": "Malware payload (Gafgyt)", "value": "ecaed52f9406e9f7ad7ff7310b976b4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239973, "uuid": "c74e517b-bb5c-40e2-819d-56d940cd0915", "comment": "Malware payload (Gafgyt)", "value": "005c1297229fb98e634ba61d108a268edf3fdb9d5538ad8299e43e5c32160484", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239973, "uuid": "da6702ba-27b6-42cd-bc62-ddc6e88e4ccc", "comment": "Malware payload (Gafgyt)", "value": "06eba3a88da466acf4e7fc3665a9dd927049bc93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239973, "uuid": "902f8579-7d88-4a97-927c-536e93138187", "comment": "Malware payload (Gafgyt)", "value": "9b0e0ef6c621514e5008401d9741de785bcea90713bc31cdf2ce234a1cd49a80fcc3bbb7459e1040a67bd0a86ad18f7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239973, "uuid": "2b7ce13e-df2c-46be-a3d1-5834c02144b5", "value": "5803E050B3985FDDC06A427A18BF3DAF1A28365C4B3E8092A5D43527DBE7E90392C582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239973, "uuid": "5e0336de-850d-413c-9c76-a06e89ea87e9", "value": "768:RV7uGrPWtlvZH0z6VLDV5tLDQEQe7TnDFOnbcuyD7UryqHyUqpGbIFm9A:/7uGrPW7vB0z6Rd9Onouy8mqHvWGbFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239973, "uuid": "9da11da2-ff06-4f1d-ab42-6c13614219df", "value": 38484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239973, "uuid": "e5f7b331-4220-4a24-98f5-fb478b2ee4ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239973, "uuid": "604b1a06-0762-4a64-9a76-0a77e51d6d76", "value": "ecaed52f9406e9f7ad7ff7310b976b4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e80789-d2ec-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319837, "uuid": "82a75708-d6ef-42a6-bbad-4cc10df51117", "comment": "Malware payload (Mirai)", "value": "256718bef8d8426f0c0a68d35a69ab9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319837, "uuid": "314b35c2-7db7-46e8-849e-d3fa8657faec", "comment": "Malware payload (Mirai)", "value": "010d4c83df911160ae3ab4ba836142424250e7adff3c311cd1fcadb025cdc860", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319837, "uuid": "ba69dd85-7da8-4eb0-af27-da362764473e", "comment": "Malware payload (Mirai)", "value": "262cdbaa49035903cd47c9b4e9da2248ac863ce7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319837, "uuid": "967f08ae-66b8-4877-a90d-fa99910840e6", "comment": "Malware payload (Mirai)", "value": "db10792e3697b6fecf31801a6328e2ef4a6adfbfb1d0f859486e8e24d9d3f71e5e12bcccd598b7c2994f7002fb546fae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319837, "uuid": "c72bb6da-00da-44f3-b8f8-b2998c480ae9", "value": "FAE2D1BDF3693054CE691E79704B0E784BD472C132BB8B8E5331AC8466355C5BB3A4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319837, "uuid": "e8b7664c-0beb-496c-8bdb-3b277121a20a", "value": "768:C0f78pr/7dItbVbi8LGNj5m74Hg2uF4B7TGecUwwvpYNAW0:CM78phI/b3G1sEHYFOfGedpYNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319837, "uuid": "9c0f5102-d9a0-4752-8655-679ae8e7de59", "value": 34024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319837, "uuid": "b249d118-73e1-4337-a458-c7cb64c5063e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319837, "uuid": "d8c1c792-aafc-43d4-9bfb-9d3a4aea5919", "value": "256718bef8d8426f0c0a68d35a69ab9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2fc7f5-d285-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624275769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275769, "uuid": "85887f7b-aef7-4649-809b-697e317901e5", "comment": "Malware payload (SnakeKeylogger)", "value": "cc613a8852bc365229345aa652ebd998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275769, "uuid": "e2498892-a53a-4cd2-aa5f-4128aff1504f", "comment": "Malware payload (SnakeKeylogger)", "value": "022e918d8b07b6bda3fc703e212db5d145fa5814f33ea2fa8a350e2be405a348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275769, "uuid": "62bca69e-4f9b-4f6c-a92d-eb64eaf4c026", "comment": "Malware payload (SnakeKeylogger)", "value": "311cf102cc11a2a142f24c5aedb8c6890e2c0a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275769, "uuid": "07346542-57b3-4271-bd2d-1b7be7a0ef5b", "comment": "Malware payload (SnakeKeylogger)", "value": "1746514a7bcbb923fd1183b741d0d94a716f175acb0eaeb572db8cb82d84f0f6b673d220ef9c85ae182dcb00d871aae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275769, "uuid": "31922c93-ab86-4811-977e-f60adc724544", "value": "5E64125A23C264E3C667B3F24A7BCB55DB6A540138434CE313A96EBE7CB02C69D052D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275769, "uuid": "14ffe2e7-8530-4100-bff6-f375202d95e5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275769, "uuid": "edee5480-e99b-403a-af97-40d1385fb19c", "value": "6144:GBlL/7XeJU4DMx636XsD/6rf74FpE8tAIRCn3tsoH6150PIEYtOG5mn88P06X:Epef663krfM68qmbL150bhymey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624275769, "uuid": "2eeec99d-f0f9-43ce-b2e3-f0c639ad25e4", "value": 307214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624275769, "uuid": "d30f7614-e527-4a5c-b2da-ee78d3d0fc8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275769, "uuid": "621d74bd-f0d2-42cc-baa4-311044a0bed1", "value": "09058009000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8024f94f-d29a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624284658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284658, "uuid": "b042315d-d067-464c-a256-96e4060a9046", "comment": "Malware payload (Loki)", "value": "a18b486195e4df3d32b24a8043d643c2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284658, "uuid": "117c3843-aa43-401e-b4cc-de677fbcae89", "comment": "Malware payload (Loki)", "value": "03165c2ce010e488f519d78a7c6e9084cae58b1dab2a3ca081836e7cf43d031a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284658, "uuid": "0734519d-52a6-405f-913b-69ed2be9537d", "comment": "Malware payload (Loki)", "value": "d0648fe49995368f1a72d4aeb2e99769f03b3f5c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284658, "uuid": "383c9b78-3e6f-4c8f-8ec2-3a288419d200", "comment": "Malware payload (Loki)", "value": "e318e1674a7fd5bd70f0a221446653e323a395209e3b4a7239dc64ad340935e482a373e0c655684542c3ed0add426b46", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284658, "uuid": "dc1e1373-4f6a-40c6-9fa5-1a35574ab0d4", "value": "60451285B840D509C16706771E6A6859C3299C08EBDB0FCA3D7E7248E43716A1BEEF3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284658, "uuid": "138314b6-6576-421b-9524-60af975155a9", "value": "24576:kmXfjGxip+MWFakG3hZNa5ddcHnBRImsdeP0n/MEJV4s/g1nh9XE:kmXixnOk2ocHBWjvRkswnh9XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284658, "uuid": "d50c2f02-05f3-4f86-b6c0-c6b033f024f4", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284658, "uuid": "06bf8880-c771-41e8-9835-6c1994230dd1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284658, "uuid": "b8f39cc2-825d-4aed-b7e1-9471c2051227", "value": "Payment list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f399a1cb-d2ce-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624307185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307185, "uuid": "2eb6968c-418a-471a-8676-eb0050a1f935", "comment": "Malware payload (Formbook)", "value": "1ea340b530b570e97f831ab1d85df217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307185, "uuid": "35eaff6c-59b9-42bd-bc25-42259e9a4783", "comment": "Malware payload (Formbook)", "value": "0359770a4f8e61754117fa40d6eb6c4ad6379a2a3e9bf0011f8ffd8c35168eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307185, "uuid": "a5763150-e562-427f-9f6b-2d635816c248", "comment": "Malware payload (Formbook)", "value": "5088ba49b9ec21171e2cfc70e3cfb31c03607eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307185, "uuid": "a2b5f782-fe7c-4975-8060-a33f1a79a9b6", "comment": "Malware payload (Formbook)", "value": "561d14fe8dfda790e37584382770b112bd28c154b9b51112e53b06d73efbda318c257463d38050efbc4a57a3e8639133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307185, "uuid": "d3c0907d-01ab-45bb-a58c-06836786f3c1", "value": "AB756B427E46DE12C1691A37D9EF962407BCFD007B26DB1A7E9B336DA5313A20D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307185, "uuid": "90612875-033f-49af-90cb-f0f9dc41b670", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307185, "uuid": "468ab918-7a28-4351-a2cb-4fb6e623af78", "value": "24576:P2G/nvxW3WC0sLkGBH/5nHSfzMRrRnLKCkuQxdCoMq2lurLfa3p50nA+4I:PbA3O45HSfanXzMfYpgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624307185, "uuid": "94a62063-4d0a-4bba-ada9-0033eb6c27ed", "value": 1627792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624307185, "uuid": "e707a926-2463-4af7-90c5-4dd1c07fdbb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307185, "uuid": "238d1c6e-9c2a-4eac-9eab-5869dfb1a9a4", "value": "1EA340B530B570E97F831AB1D85DF217.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f171578-d29c-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624285569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285569, "uuid": "e87a4c42-1a4c-4d12-bd9e-9de073c477b0", "comment": "Malware payload (BitRAT)", "value": "58efa41d1aed6af68c52e46904553216", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285569, "uuid": "47a0a5ef-4984-4c83-93af-3367f467d332", "comment": "Malware payload (BitRAT)", "value": "0523c9c53027d822021a5b2bad5d216461c060396944da4bf8cd6cc1963deebb", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285569, "uuid": "993cccd5-c667-47e4-bd6a-105ed35af9fb", "comment": "Malware payload (BitRAT)", "value": "b59c0cb1271f72598934bd30b63db5348ab3d297", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285569, "uuid": "fdc6f1a9-14a1-46e6-994b-3f719612a638", "comment": "Malware payload (BitRAT)", "value": "bb70bf0f7107b32639403c84947f634ccf72e29170e111de9ebb83013837d01e02e72e673fa849fe61527faa0362d5bf", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285569, "uuid": "a1ebcfa0-b831-44e4-a1a8-a70a5a5ff104", "value": "E1147CE17180FD73D7A986B117855AF91E896C309E54C9C3E2C4370EEBBA6E1C234726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285569, "uuid": "b6e6d8b7-d68d-4d8a-bd94-a4e1916f30c4", "value": "269fbb82c8f402e670c866cdbdfbba84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285569, "uuid": "4bfca475-13c3-4b69-90f6-9bf034e0ba87", "value": "1536:4WopBBTdfyNo8ptsYMSCF7Ym3JQmkKOXQMs8nAkYGhbOmSnKg7w7dkBFWopN:c/sLOnesJQKOM8AkNbOmV78N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285569, "uuid": "d6cab243-d9d4-4034-9c9a-15f9eecd1376", "value": 193672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285569, "uuid": "609d3020-75d7-4b96-b25e-cca3d8cf63c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285569, "uuid": "a2f98d1b-b076-4e06-a811-befcd3227571", "value": "RFQ E-BiddingRequestForQuotationReport16Jun20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2556f37-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624285252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285252, "uuid": "753d4508-5926-46e2-b8f6-8d3778e42233", "comment": "Malware payload", "value": "969226820282523d2a651d71cec45d3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285252, "uuid": "b6901261-12c8-49ec-bb45-44fc2acb2c95", "comment": "Malware payload", "value": "057da2761f16991c0939bd37394598838d7ee7e3d792c7ba5787e92c64168101", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285252, "uuid": "ade0df6d-aa77-40fd-8314-0e6df018873e", "comment": "Malware payload", "value": "bb5447cdc7d32fdc7b6849ceab9b7bcef7e11554", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285252, "uuid": "b08a1348-76d0-41d7-8de9-b1a933d5cbf2", "comment": "Malware payload", "value": "97a1810d2c325b43077fb0ee611434c5caf167a44c618e68610f0489de68cfd53797b4a681adc589c6aeec2cab2f71a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285252, "uuid": "87fce5de-8db6-4f7c-ac6a-97dcb4750a2c", "value": "E8F2F1D90E9C86BDA6320F77F16C09087671253B5C4671216F64816CBECACF2E3BE406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285252, "uuid": "f1723013-a436-4c80-b8f6-688799d80568", "value": "768:dZFhCSPN9qFxlgqjf4wm8dcDDOpyjsma1+HejT5XDpryqfa3U8:XjL9ggFBDah1+HADJfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285252, "uuid": "b5e5df29-4527-47fd-be2f-1a9acec4e672", "value": 36656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285252, "uuid": "739afce1-f5d3-4126-ab40-d967a86ce268", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285252, "uuid": "44f665a2-bd64-4604-985b-e19b2b0a9c24", "value": "969226820282523d2a651d71cec45d3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8471018-d28f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624280081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280081, "uuid": "8ec764f7-4df3-459d-bfe4-8a5c4885a813", "comment": "Malware payload (SnakeKeylogger)", "value": "80120393b3b63fb21e46ebbe247cec8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280081, "uuid": "38921a43-d3ff-46f2-a779-3a6346da18ef", "comment": "Malware payload (SnakeKeylogger)", "value": "0629bdfeaf10d2a31f4f98c94f06085be795aa0f58860819e60683b802853c22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280081, "uuid": "fd59c0ae-8e3b-422f-9efd-aafa3c937529", "comment": "Malware payload (SnakeKeylogger)", "value": "59a124b691170f96465da1f1366a9f36e665759d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280081, "uuid": "bc269e2b-a0e1-4626-b07b-be6c348ca399", "comment": "Malware payload (SnakeKeylogger)", "value": "697d540968b101220c7af525c38521b6ba2e42cab94fa11b66d0a76086bba4ab5a2b49086cc2d6310632734540a8ba49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280081, "uuid": "47521863-3e4e-41fc-8598-0e2b6681ccec", "value": "3D25AF220ECF426EE2754EB557B0BC47C2B6ADAA3705A2163DC031ADCA335D9CDEE511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280081, "uuid": "f9dc97fe-2f7b-4712-80f6-3a518c8ef345", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280081, "uuid": "dbe3e4f7-118b-457c-b271-b5e1adc83797", "value": "12288:2GJWFHms8SMPQipP5QG1CBkAcr/JfEf1Bfe4psk2xSMZXmmEqNoS3M15pFYR:zOHpip39REf/esskyScXmmE+oSM15pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280081, "uuid": "06700fa1-2618-4f05-8b43-19925f9ba6a3", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280081, "uuid": "3ac4a55d-a438-44ca-aa9e-f375f735c665", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280081, "uuid": "27c96f0a-368f-42d0-87b0-4036c8361a43", "value": "Minutes of Meeting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3af84e-d25b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624257675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257675, "uuid": "97ca40c3-f0b9-4957-82a0-0e263ea0817f", "comment": "Malware payload (NanoCore)", "value": "cc4bc38575be3f32c008aec80123fc33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257675, "uuid": "bb86e7ef-4b43-472a-891c-878cea53a7b6", "comment": "Malware payload (NanoCore)", "value": "06f08616e129f8be1c27b4935aac3f122a3c4da51b2af8b7bc7589806d962e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257675, "uuid": "50465004-fa35-404a-ac06-2433b5cc5114", "comment": "Malware payload (NanoCore)", "value": "9756e89e64f2a063e34715d3dadd32b9a62c62c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257675, "uuid": "faecef05-00f6-478c-88a5-f349e5176fa2", "comment": "Malware payload (NanoCore)", "value": "ec26886533bde311f9726457b974014cba649b262570b6f142d05f44e1707ec47ceba272f59ea1d6280b931df01d1e74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257675, "uuid": "b2535732-ec97-4bf5-bd55-53b376a774c1", "value": "8DF47CAC3190B9EEC667CE76CAA82C64AA207477530BD207512306DD9A0DBD7DF106F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257675, "uuid": "7facefd5-e587-42a0-af70-3f64da4439cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257675, "uuid": "cd72b15b-fdab-436c-a100-06ab9796b0be", "value": "12288:VFVBgk7QmeG3psN1CMUHlCJjPWoJ8EEmZCVMbKu7T7sf+Dhn6v0ONw+L0OtwL2BH:VF/gAQJGuNJLJj+oGEdZ0MbH7Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257675, "uuid": "55f630d4-bc39-4e30-a0c2-b28ad84ce220", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257675, "uuid": "56dfdf56-ebf0-4bfc-ae1b-94fb5fd06b79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257675, "uuid": "769413bc-c3dc-4994-b8e5-3085c208b0fa", "value": "Agency instructions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d67144-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624258978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258978, "uuid": "246a285f-bb07-4880-b8fc-56d4fba9b746", "comment": "Malware payload (Loki)", "value": "11c0ad7a4288d0102e29411fca9de0c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258978, "uuid": "35d81e9d-1652-4acb-b702-ac889a7cdc65", "comment": "Malware payload (Loki)", "value": "08377819d79016a838d738bb146ee24b852e3405c9247dc97dd808ab94cf56c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258978, "uuid": "0c99ddbe-1da8-41ab-bf1d-f71cbf935b34", "comment": "Malware payload (Loki)", "value": "f30a0739fa0345365c8e46a4b0fd9abac1c72a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258978, "uuid": "66cd6b81-c52a-4b4c-8016-d3b0faa0a13d", "comment": "Malware payload (Loki)", "value": "95a53d8b178aaa89fde32f2adb3fc45f334934b722bc04afa508391348ee515b6bfa6885279325774d0f20d664dbdc9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258978, "uuid": "a8960180-53c5-4403-acf7-b6f21297f2fc", "value": "68E4BF3039EE610DF577AF781AE436E2967B7E677B07985D24D4234A8723C428F80939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258978, "uuid": "823f93b4-f8d9-4c0f-a519-8f17412bef25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258978, "uuid": "95d65a0c-bf2c-445f-9343-0c7cb8c1a395", "value": "12288:hg7buWFHmsdhO3DYj/kxtJJpOk+4iMLc36k2WyvCW6ldDjDgHhU:huNHPhO3DYYrJJpLe36vWyvCWmjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258978, "uuid": "7df517c3-2ae7-49bd-815b-ba63967799a3", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258978, "uuid": "839a51d7-f569-4217-854c-247a94b56db6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258978, "uuid": "138bd977-8569-4f5c-98cb-929c62d8d3c1", "value": "11c0ad7a4288d0102e29411fca9de0c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93576424-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303158, "uuid": "9090bf36-daa0-4f4d-a603-6870de6894b3", "comment": "Malware payload", "value": "20adbd9d3558773c52e3728864e2bb8f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303158, "uuid": "a9a0e9a3-e9b9-42d5-a21d-0660dd8afc86", "comment": "Malware payload", "value": "09274470ff6ffa641a7689f945b617e02529c9de3e3ad73a1439af9e5a583f4c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303158, "uuid": "20787e66-00cb-4253-ad18-75ca2c4e85de", "comment": "Malware payload", "value": "15ec82f253dcb42e611ef838772cdc1606254fe5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303158, "uuid": "01e4bb62-4c75-4dbb-a561-32f92167d23f", "comment": "Malware payload", "value": "a817af80aa1041f2be12bebf625d3add208dfe8132c7dd5b27551db62348faeda2af41f553f0958244c11201bc593683", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303158, "uuid": "566f8cff-19e7-4ccc-b4d8-48b894d5b50e", "value": "C933D008F112DCA0EE1FAD79A1F850B076AB16B4F3909CC26C44A55D5DF315E8B3B6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303158, "uuid": "0b3e16ca-ce6c-4085-b96b-4db3a040ddcb", "value": "1536:/oH78QIOf7SieU6ZDvxjxcpAr/USvhW7OP:/oH78WSiebvxju4/UchW7OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303158, "uuid": "67a5684c-ea62-480c-a2c3-6fa92e68d6ff", "value": 51646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303158, "uuid": "407a7fc2-d781-4483-9cd7-a3e2e18d378c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303158, "uuid": "b135f288-e654-4fb3-8a8f-6d1c8f4c97cc", "value": "enjoin.06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2b83f9-d270-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624266664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266664, "uuid": "25453bb7-0e5a-42f6-9bbc-14e66ee7d2f0", "comment": "Malware payload (RedLineStealer)", "value": "169b01e33c20b0157bd1ed5204a11bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266664, "uuid": "3452b628-1a7c-46ae-8ef9-e1f6dc2b91a5", "comment": "Malware payload (RedLineStealer)", "value": "094e57f87f745785ba374ad266689bff9d71f06f736118f594c3b42cc84550c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266664, "uuid": "b56abf10-ec52-4d35-aafb-ab4d9d90d818", "comment": "Malware payload (RedLineStealer)", "value": "3227c0a5b27e3dc1e019a5acfb336e70a98f119e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266664, "uuid": "a1bd5dab-cd87-45ca-990c-df6f78da68bd", "comment": "Malware payload (RedLineStealer)", "value": "594b37397ed8ddc990e019c5d491e1b36bc2a588957c41f93a480577ff54b2545aaa0a9234c167f4f5798dd21d5ba30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266664, "uuid": "361d5f4e-853d-49ea-b746-c96db20e4c4b", "value": "3184BE11FAA0C035F2F762F4567693A8A93E7AB16B3450CF12D52ADE4A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266664, "uuid": "e31ad33d-fc2a-40f4-9e5a-f8c0cc7b66a6", "value": "123708792297e850a475b64837725c34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266664, "uuid": "9ba378e6-016f-4c9d-bd76-4e0752805e4c", "value": "6144:dsSGIYysUFyhNK3mTFqvXBPH7NTwplZYSdIOq6HRmXBmdh4406MKriuBz:PGI7sUFyhN1F+dHRT8jqwmXBkRYlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624266664, "uuid": "8e5abf30-0386-4871-adfc-837441deb1f6", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624266664, "uuid": "8166e420-0f73-436b-86c9-8ee91b15f183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266664, "uuid": "fbeada3d-7b7b-44f2-8b74-76ded45b3f24", "value": "169b01e33c20b0157bd1ed5204a11bee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc42fe2-d26f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624266076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266076, "uuid": "34c6d9b7-3007-4403-9cfa-671c5bfdba84", "comment": "Malware payload (RedLineStealer)", "value": "d1f2352569ed04e3d983af0ef50f3338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266076, "uuid": "d3b85f79-f51c-463b-a6c8-d70bff5e0860", "comment": "Malware payload (RedLineStealer)", "value": "099b9f0cd8ae3f24a141c023a7eeb3e6e7f228bd5a55750481e9b14dbf898ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266076, "uuid": "22527d95-4fab-4ef0-bc1b-019ccf3ac6eb", "comment": "Malware payload (RedLineStealer)", "value": "78f16c019010505456ff4e2905ee652e4e1b78c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266076, "uuid": "c7a8dd3e-fd01-47c6-a4c0-0687cab69c76", "comment": "Malware payload (RedLineStealer)", "value": "48cd35a153badb42653a83d7eeb9956148040be2af22be1ddd0de820975fd29ca0812250df099a13a299c9c668d18c8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266076, "uuid": "b53154e2-afad-4c16-898f-fc72cb55ea6d", "value": "0C84AF10F6A0C035F2F752F85A7A93B9A93D7AA1672050CF12D52AEE5A347E0EC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266076, "uuid": "f529dd94-7d9e-498f-9786-5604d8e674db", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266076, "uuid": "0cb85a66-140f-4ff8-9983-6b5bbcaa013a", "value": "6144:GoHzHYjAiouoNC3mfFWnGDEs34+ko2gFo1TWmi4JxsZsKrifBz:7zHyAiouoNxFpDEm4+DFo1TZ5lV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624266076, "uuid": "8d3344c4-f09a-40e1-84dd-60dbf15a3d48", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624266076, "uuid": "3af9c481-3587-4fd2-aff0-443bee9a67a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266076, "uuid": "27b58199-55d6-4176-8087-b048c767d1c5", "value": "d1f2352569ed04e3d983af0ef50f3338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77e0f77-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624285234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285234, "uuid": "da2d4b6f-b52c-47fb-8e8d-7cb5b22e23fa", "comment": "Malware payload (Mirai)", "value": "bc0674fe0a31b7de7097eb8c2406f158", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285234, "uuid": "43f82566-3aa3-4677-a27b-3662149f4794", "comment": "Malware payload (Mirai)", "value": "09e9a39e0e7b3728451ffd54d0747a19cf600f61657e13f77f7e26400f5538a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285234, "uuid": "3ccad1aa-54c5-4cb1-ad80-f57ef1fa6283", "comment": "Malware payload (Mirai)", "value": "a5b04575b73c1bbd0fa70c850525399460389eac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285234, "uuid": "783fc653-623a-4a1d-9461-c91dc854a583", "comment": "Malware payload (Mirai)", "value": "e7bb80070e36e960117bb1e976f24396ac9845d7d892afc680e79eca35cc51f58f6a84bcd265ef7e571a24a73b0d6782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285234, "uuid": "a6afe044-2f21-4e34-b911-21440ec2dc12", "value": "D2A34A41A640DAB3D19305B6129FDF150532FBBB1B2BDA67F36D3CF48A504857222FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285234, "uuid": "cf9c48cd-4c5e-467c-8c3c-7fe06137f3c1", "value": "3072:8f53U5GXRJr055Qih5NJ5hO4l7Q40Qz56YQ24k:cvBJI0MNJ5hO4l7Q40Qz56YQ24k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285234, "uuid": "dba74703-6146-4702-89de-8606d5a80186", "value": 99898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285234, "uuid": "a9880421-c8a6-47c4-8c47-95a9e6fc94b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285234, "uuid": "7327604f-ab7e-4f34-936c-1beac283b6bb", "value": "bc0674fe0a31b7de7097eb8c2406f158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a585942-d233-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624240302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240302, "uuid": "0a58aa4f-d350-4d1c-b883-ea9cb2a21f97", "comment": "Malware payload (Gafgyt)", "value": "3211aea3b6369883e4314870c4476eed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240302, "uuid": "2b6b6010-653f-4c16-89ba-794f8973abd5", "comment": "Malware payload (Gafgyt)", "value": "09eae780a9f4002accf62d409e3c2fa762a8d8b7bfa5fe33b4b09ed71098ac8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240302, "uuid": "c85e20e2-9977-48ef-b700-23a678463d97", "comment": "Malware payload (Gafgyt)", "value": "9ddb8bd777de34e5490e307bc0a333f9f15437de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240302, "uuid": "cf593c4f-7200-47f9-8c12-0d73aab06d94", "comment": "Malware payload (Gafgyt)", "value": "9fe397ac4d53541ebfad793c449c0656bdee2a15fb76ded0535fdd37c8cb2555a4cd6e8bff18f4192ac15e5f36f9fe73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240302, "uuid": "0d45913c-8171-4933-81cd-e20dcebf6582", "value": "1903F1139B53B9B1D0842CF6F6FA018B525207B8F87F958866E4A77CD4E388161FC968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240302, "uuid": "6762c9b9-a9a6-40cc-a19f-7d357de6a3d9", "value": "768:662RZBykWxEZlb1XY+VUxTlr9kjnJ9xul3UKpoImN9i0y:6DBCEZH3ehr9kXxM2ImNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624240302, "uuid": "c2cc002f-d896-4d7f-97fd-b80cd5a96c93", "value": 41288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624240302, "uuid": "87bad684-d712-47a3-b134-01cb186b7b77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240302, "uuid": "f4761582-56d8-40c3-8fcc-77f5a502ca39", "value": "3211aea3b6369883e4314870c4476eed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e758740b-d2dc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624313178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624313178, "uuid": "a19494af-6c23-4b21-b5da-6d067fbbc0b8", "comment": "Malware payload", "value": "bf8b700eef6de59e19fe6aefc7185e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624313178, "uuid": "6f260970-f0af-4974-97db-546a371ea5b9", "comment": "Malware payload", "value": "0addfafe0e5f26952199b892cd6e822800e25cde1c6738fef6aac32d01d42704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624313178, "uuid": "cfb2cc13-eb0e-4434-aac8-18543bad34fd", "comment": "Malware payload", "value": "637024569706511daba4f2b300755451b1d91555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624313178, "uuid": "bd976f54-9fd3-48f6-a562-affdd0cecf7b", "comment": "Malware payload", "value": "d7cf9212b1e346d5e37be8fd3944e8c07fbea1e325a391f856716f66a2e2c64d729250338bf73e13ef70ed9d2142cfc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624313178, "uuid": "e1194096-703b-4b18-9151-80ab637bc9f0", "value": "7664C14DCA8B417687FED3BC106DB97BC80A0A1DA9F736D537B29461D69070B1CEB209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624313178, "uuid": "df862506-b44e-4bca-a524-041557f99a89", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624313178, "uuid": "743e2381-3aa2-4f87-ae2c-0acb7dfb87ca", "value": "6144:11YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:zYlNRmFJC8y9hrqGdVt5rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624313178, "uuid": "9035effa-acad-40aa-a8d9-06af7bbd4502", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624313178, "uuid": "2ffc4aac-97f8-411b-8202-e3e44ab7d1a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624313178, "uuid": "d82787a1-5103-4643-9e57-34722555c56d", "value": "9NK9X6cfO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104b94a6-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624298643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298643, "uuid": "318491ee-3f66-4cfb-9273-29997ed5e4e8", "comment": "Malware payload", "value": "25d8cefcd47eafa6fe575b02c3c65bcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298643, "uuid": "ca8853fc-2732-44de-b56f-50a1d3acd8ae", "comment": "Malware payload", "value": "0cc079cb6d771feb5394759239a5f44a66a066f76d75d77f70925091839298b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298643, "uuid": "05814721-531c-46d3-bb19-04303c3b25ec", "comment": "Malware payload", "value": "6c619da7c96c4280e0fc46bc25059c0840a9ff18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298643, "uuid": "e241ed66-80c5-4b34-bec6-645d0e04d393", "comment": "Malware payload", "value": "392e745ba2d1a37ffa50e911d679c75a59a90e486a40344b560777cf8b01f67b478842d72e7cb5f9d4cb76edb017501c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298643, "uuid": "ea5718d7-b9f5-425c-a562-c7c612be711a", "value": "F5452341B658E060F1DD077158BA8A631C767C4218A4CB2F6364FF9D3F63A71E62BA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298643, "uuid": "0a62f779-30b8-46e3-8e51-c84880275a21", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298643, "uuid": "57bb8a31-cce8-45c3-ba79-e8df9f5f043d", "value": "24576:mM/01ZoMRJj7T+/8r3zlH/gsGPlS/RhQifTkxJ0A0tkNr:101Z77TU8rjlYK49ulkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298643, "uuid": "2298f1ce-a88e-4cfc-8695-d47945a6e73b", "value": 1262870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298643, "uuid": "d21ccffc-7170-4523-be98-7f7462966ab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298643, "uuid": "7ba007ed-2ac7-486b-b1bb-4fe6fed8e267", "value": "25d8cefcd47eafa6fe575b02c3c65bcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02756712-d2cb-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624305492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305492, "uuid": "c01e8dd7-6ac8-4716-bc5e-79d8a9714022", "comment": "Malware payload (CobaltStrike)", "value": "133e84c588f954a11e7bf6d2b383696f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305492, "uuid": "6e10425a-c7af-4bff-ab62-632593df57bc", "comment": "Malware payload (CobaltStrike)", "value": "0ce6ad36ff912286baa98105cbccab3457b2b0fda0796b51f898b695146c4022", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305492, "uuid": "1dd96b8c-4024-4d42-800c-807ffbe68ca0", "comment": "Malware payload (CobaltStrike)", "value": "a822ca2b57511759c711e95e91a7ae7431735689", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305492, "uuid": "d120cdd6-529a-4b4a-b89e-fa0bdd35595f", "comment": "Malware payload (CobaltStrike)", "value": "4b166a3a04ddbe46212c000507e092daa38680949930abd3795f87c52c6e2923b7252c73131f17496772309eb166fb93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305492, "uuid": "ab165531-3002-421a-9e69-d65d501f0747", "value": "E864C14DCA8B417687FED3BC106DB97BC80A0A1DA9F736D537B29461D69070B1CEB209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305492, "uuid": "b0916865-068e-49ca-92f9-a1b316b8348a", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305492, "uuid": "73c4910a-90c0-495d-8e7d-2b8cd3b0b601", "value": "6144:d1YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:7YlNRmFJC8y9hrqGdVt5rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624305492, "uuid": "8f6a02fd-ec32-4b55-b818-91ed8fe63087", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624305492, "uuid": "5994c8ab-e896-40f4-a64a-2105c44f2edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305492, "uuid": "a0d2785b-f7c5-4cd0-ae1d-bdc01e268ee7", "value": "133e84c588f954a11e7bf6d2b383696f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3598d4e-d2e2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315775, "uuid": "8fad014c-c298-441e-a931-130ea4a8008e", "comment": "Malware payload", "value": "5157ef3be47e9f69027695c991c97d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315775, "uuid": "b8aac3cc-ea33-4251-bebd-3b7814c7c3f5", "comment": "Malware payload", "value": "0e7d47d02dbf786e1ef085d503d512aba2c311400b2141771341d83dbf96cb4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315775, "uuid": "6717dda4-a6fe-4a34-b1b6-b7906eddc389", "comment": "Malware payload", "value": "c56d8ca8823b8b126c305f35b06fa22d3bdaad1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315775, "uuid": "576f73be-1f43-4777-bf93-143ac82b9db5", "comment": "Malware payload", "value": "6988d1ba1390331e9fbb3ed325472c18d717cf6c0e7a66d17bcd2295ba9de7a84dbd22bd44a2fe6156c4a184eeae8d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315775, "uuid": "41e6c3f4-3327-4276-a48a-537d24c7a0d5", "value": "1B04126CE06613E3CF5C35F49518DD7B958BBB573D8762FC3B60E888913821311A6B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315775, "uuid": "6e333336-6fd7-400f-b63b-16608109fcab", "value": "3072:y/d1+lqZQW3hoLI2G1PPYz4HZfEeHC8Wr9hukjmc5FQa0iFj3NREsYrT694pwN0z:y1YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315775, "uuid": "408dec6d-3c3d-4378-baea-d61b3ec49bc3", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315775, "uuid": "26d83515-147c-48f8-83cc-15ecd87b073b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315775, "uuid": "3a349528-63d3-447d-82ac-cf307c1d4745", "value": "nprXfl6Q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9421cbab-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624259351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259351, "uuid": "1a4545d9-f052-4002-b98d-d79b68a99f3f", "comment": "Malware payload (AgentTesla)", "value": "99ea279fbcfa0af20a5bf1a9a2ed9201", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259351, "uuid": "9969030d-badc-4682-8d49-346db5bbba0a", "comment": "Malware payload (AgentTesla)", "value": "0e8eb65966b1b26fcaa9aa06bacc4df9b0f689b63063c0118e42c5057bb1649e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259351, "uuid": "4b0c0bcc-694d-4647-8199-3fed20fc40ad", "comment": "Malware payload (AgentTesla)", "value": "b2d9cceae8bd961e43ed146ab136aaacc57ae565", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259351, "uuid": "e9218e4a-65bb-4ee9-be28-3d1689281c70", "comment": "Malware payload (AgentTesla)", "value": "aef004d07d570cf802d7198bae94a462a95328b944ffafb5f026ee868a21a112f9acf7afcdedcd6c9a820ccbeb2c2cd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259351, "uuid": "a9121ef9-6df4-42cb-8b47-70216fb368b8", "value": "4435232AFFA78B4AD4291E7458ABD49EA44C7D11FBE1CC473216356E6572F30408A0AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259351, "uuid": "c6fc80ef-6e44-4b4e-84cc-51eb24d2b69d", "value": "12288:/9ts6fhyKLX71Hg5pavesi8K9GAXYGTl1YV9sduas39bB/QQ2fN4M29mSMlnBAsd:VtPfHSiVY3lEs1c9BplOlCzTsa9Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259351, "uuid": "af55050b-8808-463a-9211-0a0fb1a61128", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259351, "uuid": "e1c28215-3b1b-4c89-918d-50c318115993", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259351, "uuid": "0b7120eb-92ca-480e-8c24-91d8ce69511d", "value": "No3756368 Norma.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54270d3-d241-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624246548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624246548, "uuid": "0e8374ab-aad1-41fb-a9af-5b56e9205476", "comment": "Malware payload (RedLineStealer)", "value": "ac321982323dd0f5c891fa383111c99e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624246548, "uuid": "f1270f7a-7d57-4623-898d-1b2594c18bf4", "comment": "Malware payload (RedLineStealer)", "value": "0e99578780beb23f12a98370589691fb240b77f0d62e98e5714cf15d87cdfb2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624246548, "uuid": "1d9fd628-e8af-4afa-99d8-c0e8bf5fff3e", "comment": "Malware payload (RedLineStealer)", "value": "d17e35999463b707b4efb24cbc899ca8be357498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624246548, "uuid": "fd56e9b3-be6f-4ddb-803d-04cade90f961", "comment": "Malware payload (RedLineStealer)", "value": "2a2053d541470a12505d2163b105a51490dcc1e9036460e3fe4803ca2e7531f010c4eaca2f8f725faa319fa356a85fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624246548, "uuid": "975cfe90-917f-456b-97c8-378f2898518f", "value": "FD94BE10EA90C035E5F762F95AB5D3B8A52D3AB0972450CB52E52AEF5B387E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624246548, "uuid": "dd842468-19a5-49e8-bc55-621967a94c3f", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624246548, "uuid": "d3e683d2-9a80-464c-ba4d-c781b1a52dc1", "value": "6144:Xd8E0IHlHk8guDtSTkppweEZBDOTPYwvo6hjto0/YHv2jKri:r00lHk8guZSgp7oBDLR6t6004l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624246548, "uuid": "6d60f87e-23ee-4a45-aa97-bf6da086028b", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624246548, "uuid": "1abc6394-eea4-4cde-9db0-b67e116832ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624246548, "uuid": "59ecdaec-aeca-40c8-aeb0-d201ee30b6cc", "value": "ac321982323dd0f5c891fa383111c99e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078757e7-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258256, "uuid": "a24543c9-48d9-4193-9c6a-57250709a345", "comment": "Malware payload (RedLineStealer)", "value": "0395b66a6b88d2e8204efc64117010ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258256, "uuid": "9a068f9a-c649-4df8-988c-1a62f9f02325", "comment": "Malware payload (RedLineStealer)", "value": "0ed3eeb987ecadb5659e4e8db1fdd6e4239d89059fd191f09933b3e15b5e1ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258256, "uuid": "64c11cef-4216-4453-b90e-028f628429ba", "comment": "Malware payload (RedLineStealer)", "value": "2dd2d187c17467c9e599aa55d843d02c248b940e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258256, "uuid": "a5568a99-183f-45ad-b495-6943a6cf4b61", "comment": "Malware payload (RedLineStealer)", "value": "acb3aff59ba893532a9769eae825295a499c4787382834eac063195fb61cbf2c0c71743cf2a7647baac29cc6d0174e9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258256, "uuid": "3c262eea-683d-43a4-ad4e-e90e8f8ca267", "value": "CD84AE11FAA1C035F2F762F44A7693B8A93D7AA16B2050CF12D56ADE1A347E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258256, "uuid": "9a9261a1-12b7-48b8-91d5-2aebb1a55ea9", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258256, "uuid": "85ac68b5-1c87-489b-bbd2-854a33be90c6", "value": "12288:W2GooIiJT4thK82u01/ri1b43wUjZ54l:WEoIiJwP01Di1b43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258256, "uuid": "0c7a23f0-c6b6-42e5-be7e-80a7131a04ba", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258256, "uuid": "4fea8ccc-7e50-48d4-a9a8-f13104d47a00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258256, "uuid": "221b2723-e8fd-4265-9f28-9903e53bd192", "value": "0395b66a6b88d2e8204efc64117010ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fac289-d2aa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624291704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291704, "uuid": "cd1f8710-4ef1-48e1-8ebc-e58e48b87b6b", "comment": "Malware payload (Formbook)", "value": "fc84fa2377e61c5966299fa9c77df175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291704, "uuid": "991f0f69-543e-4411-ae75-136e233f8166", "comment": "Malware payload (Formbook)", "value": "0ef48a153f8c6bb66544df3a1f3c66970439825dfc1eb61f9cb4f9a18adedbc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291704, "uuid": "7dd3652f-3ca4-43c5-b592-01029d420d0b", "comment": "Malware payload (Formbook)", "value": "060e0a285e83698d5a528076b866a74b0c254dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291704, "uuid": "e6977b45-181d-4d94-8148-e5f8d8ef827a", "comment": "Malware payload (Formbook)", "value": "9a331cd0fa610ca28a0d4db1093c32e8fcf9bc1db504ade8802cc1fff56b80d2236db287d461af9e1362e1261191e81f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291704, "uuid": "4621b0b7-b86e-4216-a24a-5946e23cf005", "value": "3D35C0220DCF4729E2754E765BB0BC53C2BAADA62705E2153DC0319DCA336DADCEE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291704, "uuid": "5689e7d6-35c3-443a-9648-b4550fd26684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291704, "uuid": "0dc9bbd2-a114-4724-83cd-16416b482d65", "value": "12288:cBK23SMPQipP5bG6xEnbstUrvzCdM/fuhZon90HwRuifYMOa9eSfYDW5Hms:mqipRG6xEnb1WM/GkmJGY69SAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624291704, "uuid": "70277776-20d5-4d5e-a2f8-94be936745f4", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624291704, "uuid": "55c15a03-8c6c-400a-a0b5-b91aeee251d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291704, "uuid": "f7990a29-7ec0-4d7b-b90b-81e33d92bddf", "value": "Nuvoco_RFQ_21-06-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba26c1d-d2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624310796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310796, "uuid": "ef257ad8-a0be-457b-ae6f-57a7e4383251", "comment": "Malware payload (Mirai)", "value": "0442f73be6b7af3623f240dc88593ec2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310796, "uuid": "93fa22bb-798e-42f3-b940-b03ef6cdd456", "comment": "Malware payload (Mirai)", "value": "0f1cd153d1432e455f16de34df1795279ff220eee1aea2f632121aa9197e3f2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310796, "uuid": "8c2f4f7c-e98a-454f-b005-a471d21424db", "comment": "Malware payload (Mirai)", "value": "11494365ed478574bdb686681a6bd032175580d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310796, "uuid": "f5aa2255-e778-4737-81aa-08d54d9277cf", "comment": "Malware payload (Mirai)", "value": "4dfe590b5e561ab025685505f63713d69d503da9903de022d6894823ded75f27f09f1988c6c88cafd9d62e6b8161982c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310796, "uuid": "07749a8a-f8d4-4929-b816-802db50c0ed9", "value": "AA33BFA6C039BD90D0054774A8258B790763E94293672FF69B84C6B5904BEECF31D3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310796, "uuid": "5b9ebc0b-011f-40e9-a5e6-0a1e038285c7", "value": "768:xattc8wt38AL84R0Uea+PUnFjwVT8/j+DORgE9W9/qOCNohTFfexCAYEwP:xa88wtMEy8WO6sgE9Q/qO9hFiCAYEwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624310796, "uuid": "4b9f3703-8f59-4cd2-b366-6235f0c93f56", "value": 54908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624310796, "uuid": "40f538fd-11f6-4d33-a616-2c3cd74b0c47", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310796, "uuid": "22828f99-037a-4081-aaa0-a9643d6a7aa8", "value": "0442f73be6b7af3623f240dc88593ec2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e417d31d-d2ad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624292986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624292986, "uuid": "0a195131-7382-4a96-b183-f4fd8ccd2956", "comment": "Malware payload (AgentTesla)", "value": "bfcb3ce429c7fe2bffea50ce0dded3ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624292986, "uuid": "5086c574-12d8-4bfb-90dc-4cb09b5c30ab", "comment": "Malware payload (AgentTesla)", "value": "10a8dad91e89be92abcf69116e97dd758b8860dfcdb08b6f88218cb92bdb8fd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624292986, "uuid": "8389bf56-5718-48f7-958b-b8a266b4f185", "comment": "Malware payload (AgentTesla)", "value": "16473027b51f4f5d11119fcb41cc88ecc87cfbeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624292986, "uuid": "85bb96c5-78c9-44c1-958d-a1655c3b16bd", "comment": "Malware payload (AgentTesla)", "value": "9571b8ca85aa5c33e19f255ba4a6866e0f4d268b7b918991369e82f3ea038d73a9f0547e1e5d8d352d4887f801b5ce3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624292986, "uuid": "0cbe0e9d-ef92-4718-87dd-f1fb1c29e8c3", "value": "0235CF220ECF426DE2754FB55770BC8682B6ADBA3605A2253DC031ADCA335D9DDEF412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624292986, "uuid": "020123d6-ffbc-4f5d-b771-523ba3bca5cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624292986, "uuid": "362dbd93-957a-4f16-b13a-2e81a891746b", "value": "12288:Bn5yWFHmsaSMPQipP5EPAtp+8TKQIvyht6phH5zT6q5iN5ibSNZ94nhmqwG09:7pHLiphU8TKD6b8X5iNQbSjinhm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624292986, "uuid": "0fbf731f-b9a4-4d8f-8eb0-c854f1aa0c10", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624292986, "uuid": "75306ea3-0d0e-4047-ae2e-52fdaf336085", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624292986, "uuid": "a52098c9-fdd6-4478-8134-ec14196b5b85", "value": "CI-PLHBL MBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601e5ced-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303502, "uuid": "745377d7-b783-4a1b-8737-d3be6e1fcf6f", "comment": "Malware payload", "value": "39b3dbd3e598abffe6ae89187730b212", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303502, "uuid": "4532b982-56bb-4b9e-9265-3c566515c41b", "comment": "Malware payload", "value": "11b36880249acdc464cf11c56487f3b429b09b6d28fee18cbd0dc51b754096f4", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303502, "uuid": "8febf5b8-1774-46a2-a567-0dd477b4137d", "comment": "Malware payload", "value": "28357c5a4f67275283bdee42b6e7af96466fce9a", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303502, "uuid": "1c63d21c-c0f7-4768-9cf7-c95dc6e4db91", "comment": "Malware payload", "value": "ac08b3932e0c94458e2fc9a33e35d95e80c19477e7ddafd68821d77f15bb843aa6dcea33c8708236e0686bbbcea9315e", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303502, "uuid": "dc71277d-1e89-41d3-b5e5-ff1c535f7e8e", "value": "AC517488DC72CDDC17330884393F9209ACB8D9224751C4AACEC5D9825D50FF8EE97DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303502, "uuid": "bd475f35-d9ee-40e1-a204-58575efdc31c", "value": "48:3Zu2mzAVX8nt9xj0+QT98ZPj3tiLgXap+UGj1CTt7BBZvT+5dwNHweX/9rXQJ5db:36AcY+DjwgXap+UGBahvRoEQeVJMKouc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303502, "uuid": "b6d39b46-0bc6-4bb9-83c7-46e52f9b609d", "value": 2886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303502, "uuid": "35d21b5b-2f8e-47c9-ac61-91b04ae0aa47", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303502, "uuid": "d88a5261-7784-4a44-8122-419e06ce2af4", "value": "countTitleGen.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f241a260-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624285279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285279, "uuid": "9930abcc-ea7e-4e9c-a488-e5bf3215b884", "comment": "Malware payload", "value": "8f9a45f616214233c6169933538cff76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285279, "uuid": "cf08a4d3-5cc8-4191-af3f-db146cff7611", "comment": "Malware payload", "value": "11e33a7ef6acf1c7b8a8d9aaf9898f79ffd9aac3ff76b34f98985547631f577b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285279, "uuid": "82d99ec1-3340-4bb1-834f-c6ab90c81c18", "comment": "Malware payload", "value": "894ba2d1a641ac6a25cd45eb2a7f3a1700bffecc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285279, "uuid": "ca917798-05cb-48a0-9b65-44dca1f2bbce", "comment": "Malware payload", "value": "3466ba3b5754fd1f725bc5ae427e789b8b106bb934570005eb2c25562f571ca02eaa1a056902b851b116ba5eb1733660", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285279, "uuid": "f5400619-ab03-417d-85c8-f9fd71d88ba1", "value": "3DE2E10066A98E10D57A90BD8DFD6AA90C54E30DB32BF6F39F6C47AFC10176132A9356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285279, "uuid": "352993d4-cb1a-4f89-bda4-5cfe87149cae", "value": "768:trKBirqroAOaMCNHJ3jNwtiM3tRVI9CNTSYDKRnbcuyD7UryqS:tr+i+JOKNp3jNwwLQNVDwnouy8mqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285279, "uuid": "73411a74-28e6-4701-9b28-9a259857ee5b", "value": 34100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285279, "uuid": "35eaf311-7628-4708-88d1-0732d837826e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285279, "uuid": "4a2be866-5c8b-41f5-aefe-aee7e0333416", "value": "8f9a45f616214233c6169933538cff76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab0cecc-d29a-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284702, "uuid": "3b509b90-94e8-41c2-8374-803c8b8e0769", "comment": "Malware payload (Gafgyt)", "value": "d4d6a59eeccb32f5c7300f1d50f403c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284702, "uuid": "1758444c-aad9-4a89-95af-125b7be561bb", "comment": "Malware payload (Gafgyt)", "value": "1281191d5d2700119552299785af2e590277fc4a13f72f28dbdc942d68820625", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284702, "uuid": "0c4fb1fb-1fed-45e6-b2ba-21ae9b2dada9", "comment": "Malware payload (Gafgyt)", "value": "103ff814d49b9edd9ebc976ad68af5788bf3b16e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284702, "uuid": "00577955-5e34-4df2-a1be-fce5e2ece2e8", "comment": "Malware payload (Gafgyt)", "value": "6e6fa0f0eb3836902198aa033c3a98ac19a56ccfdc2a4884fc4b6b2812b1fc6f7c035adc3893124178ff882dacdd5a71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284702, "uuid": "6f5ec18b-472f-44d8-a627-4748e7c44cfb", "value": "F3833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284702, "uuid": "5c6937cb-172f-47fd-bfe2-b890e7994528", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCRdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JiBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284702, "uuid": "d2decf65-6dac-4b12-9ff7-0d3602c37f46", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284702, "uuid": "f974da1d-7979-456f-bd9e-70b594d44717", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284702, "uuid": "e882abba-56a6-440e-8df8-f3f95294108f", "value": "d4d6a59eeccb32f5c7300f1d50f403c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e58552-d2ba-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624298403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298403, "uuid": "38b00602-0eda-41f7-a16e-5a2558cd451d", "comment": "Malware payload (AgentTesla)", "value": "0c6d296b19f89199fb57c65de9f508da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298403, "uuid": "f0f1e7f3-09a3-4275-a90f-4b3c7f76dad7", "comment": "Malware payload (AgentTesla)", "value": "12f2bd047cb5264959503a455a31427d720c109669c7a8c23c9949627ddc0c63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298403, "uuid": "15e45996-5052-4c21-ae7b-b232bdb316c2", "comment": "Malware payload (AgentTesla)", "value": "c9b21f885ddc79fc7e747b55fdd4b8ef3412dd2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298403, "uuid": "e4724de3-abe8-4c49-8936-ddfe9bedd0d2", "comment": "Malware payload (AgentTesla)", "value": "75c54e4d4c4d79516bae570142c1cc03b3763692f5d1e83a7f393df8c9389c8d851f5d9f80125848c80f4b5cfd67ff6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298403, "uuid": "9192cc63-26bf-4c82-9fae-5a84da98427e", "value": "D394229174439D13D717A476B82D530A20A4DD9B4A88FB7384A2363F0939F9AB9C178F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298403, "uuid": "127a5118-0995-4ddf-a7d5-dd4e7881fece", "value": "12288:Cg4zMt7gnB8qCbbT77VL2+l439jwDdl9oP0E+9Qf:CgMMt7pqCb/X7W9kDJoPXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298403, "uuid": "1578fccb-1c19-4457-988c-ef5a8cb0b51f", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298403, "uuid": "17487ff0-645d-4683-a2f0-2d1601948521", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298403, "uuid": "fd58b445-14fc-4f76-9697-21c79813eac9", "value": "PURCAHSE ORDER {SC_20210610.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3a0de9-d28d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624278883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278883, "uuid": "e66d15dd-0148-43cb-ab98-b2e352643e1b", "comment": "Malware payload", "value": "d2faa422173a152dc30569395719966e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278883, "uuid": "ab20fa3e-22d7-4094-847b-2db38fd27ee8", "comment": "Malware payload", "value": "13da70ca42b61fac1c406a83f7db295667a03250235e22281b8f12a5f8a6c599", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278883, "uuid": "3049f0b7-8e16-4f5c-bbf4-33f37ccdf10f", "comment": "Malware payload", "value": "cdddb1b9142d3e49b2d2c8a0e9200839d5046a26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278883, "uuid": "4672c069-b327-4484-b144-9e03ffec2164", "comment": "Malware payload", "value": "998d34321ddcb2515bd83f596e38302fea8d32a878cac5fbfe330173886b899a907c16bfe330e0c0e8cc98cc6b586bf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278883, "uuid": "f820afbd-f059-4ab2-8d87-4cabf87ec513", "value": "6F72E79C78D7EB1AC1E0D6BBFA0B9BA833A553D8D2DB37138514934C968365D8F12B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278883, "uuid": "7c353ee8-5ea8-4c1f-8f77-ed798a00a2b7", "value": "384:Qzz5XZfdsKFZ6bWacwtd2/PTEWsajfo5yS:4plsKGWwtk/Pa3QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278883, "uuid": "3e8042d8-b555-4f8e-b6d0-c65377ab55a5", "value": 15996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278883, "uuid": "ce406a30-954d-46ce-ae18-f9155bc423b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278883, "uuid": "f9ebee8d-ba0b-4d35-bb94-130ff82f4a4e", "value": "d2faa422173a152dc30569395719966e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b88dba6-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284972, "uuid": "74ab1953-0ccd-48ca-bcc4-8b6f0c147e5e", "comment": "Malware payload (Gafgyt)", "value": "21eb1de408e43a1b0d4c6debf2a2b035", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284972, "uuid": "081879bf-51d6-4312-9f26-e7950fa7e217", "comment": "Malware payload (Gafgyt)", "value": "141b4184f5630e47ec58a57ec3701922ba78673a7992a5b170e511afec75dfd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284972, "uuid": "5df6c4d3-a7c0-4e89-9628-69bdf69085f2", "comment": "Malware payload (Gafgyt)", "value": "37f7fa144c2447b81acbff49d19dec4095eb122c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284972, "uuid": "9ee0b8e4-20ca-4b14-abe5-d04859c4e08e", "comment": "Malware payload (Gafgyt)", "value": "556b8120e722c89e1f19365b96381517e5f27665ef5f9406bb7d76c027e167002de400b1b2e52823c0c6b18c72469e5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284972, "uuid": "807675ac-6885-4669-847e-5f53e98e0483", "value": "EF833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284972, "uuid": "4227b293-0a83-412d-bc0a-49bbe9281931", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LQWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y02oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284972, "uuid": "d0aa94e4-58cc-4a56-b88d-a8c4b62342bf", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284972, "uuid": "d02c0f71-892f-453a-8fe1-5e07f6394bd1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284972, "uuid": "1dcd96a7-7dd0-4158-999e-7967d168015e", "value": "21eb1de408e43a1b0d4c6debf2a2b035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742423e3-d29f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624286785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286785, "uuid": "55e9617e-0c0f-4379-98ff-dd91b8fab445", "comment": "Malware payload (SnakeKeylogger)", "value": "b221af31a52fd1186f263317f04b96e4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286785, "uuid": "cd1f1407-2519-455e-8f42-e14b2e7a57b2", "comment": "Malware payload (SnakeKeylogger)", "value": "143b430b2cf5363e24a62b531370f5b765ee78138f9e7fd98266724da353d29f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286785, "uuid": "1f9cc9cb-1e8f-46f4-9867-64b35e7f0282", "comment": "Malware payload (SnakeKeylogger)", "value": "85015497923e8d33aef9f60730d9bd737aff1646", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286785, "uuid": "dc1f59f9-746a-409b-9d49-0b450a5a0d7f", "comment": "Malware payload (SnakeKeylogger)", "value": "6e133562d99498cf8651b6cacb35db64dcacbb12a3013c8e200ce0d68207142035091a024e5a8ca96c6711cfefc9eedb", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286785, "uuid": "4cf5f080-d3f8-488b-9645-d67def739348", "value": "98B423FF3443F358B4872BAD956A0A8D156EBDC615C97CF83429EF6917640CB2470938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286785, "uuid": "42ea149e-c998-480a-87f1-57cc620fa6ee", "value": "12288:5oCkj+YMBzcXImK90I/GAkDv1C0m2o8X9vBMnHeyRWFZbn:5dkCYuzeG97+PRToYFC+OWFJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624286785, "uuid": "445b4b79-e4fd-487e-9c00-0979b868dd92", "value": 534442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624286785, "uuid": "c91ba1fc-e9bd-4bc8-9f12-37234213c4b7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286785, "uuid": "57ab747b-dc9c-4b99-96ef-70992865d499", "value": "RFQ-YEKHA-20-0151.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99ca9ea-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258555, "uuid": "8260b9cd-ea50-4c5c-99a6-58ac475c3faf", "comment": "Malware payload (RedLineStealer)", "value": "fe5c49e95574a208cdcd0cbbd38d4e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258555, "uuid": "904a3d00-cd23-4590-b05c-165a7d8895f8", "comment": "Malware payload (RedLineStealer)", "value": "14cb2597414f705abc44a0c54322f995d4ac54b75b50daf64dc3b61895c9f6ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258555, "uuid": "ae7b3c3a-8f7f-4fd4-a0ee-59b2c8b7d432", "comment": "Malware payload (RedLineStealer)", "value": "c79e4a68e3499f66d6ed628911aed4868ce362ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258555, "uuid": "6028edea-bad8-43f8-9c62-db2f1c5af40e", "comment": "Malware payload (RedLineStealer)", "value": "dff73df65d3639690acf242b6d12380fd6271701a154b1745d92ca5e74078c3b1edfbde9fdb047e031e21db1684cf41c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258555, "uuid": "309149e7-6178-4683-b37b-14a6799b5c24", "value": "7984AF11FAA0C035F2F762F40A7693ACA53E7A616B3450CF52D52AEE5A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258555, "uuid": "da56f071-f015-4d4a-8f6e-8e9e4ba16737", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258555, "uuid": "2185ed56-6b2f-482a-9806-14a5f2695fad", "value": "6144:RgG2QIaoviJXS4tkOGhK85JOMnfJ/z1ZLdQKFKRsoVyhcdKriC:x2QfoviJC4t0K850MfJ/z1rQKFKNtdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258555, "uuid": "7e6e679a-8ac2-4554-9978-5b8cde582da3", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258555, "uuid": "d8b9e487-237f-4503-83e8-f26404ea23f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258555, "uuid": "2f98c3fb-2989-4af4-8341-c9a440ddabd0", "value": "fe5c49e95574a208cdcd0cbbd38d4e04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8747877-d255-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624255224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255224, "uuid": "dcb3de9b-9693-4082-8764-8d23d74e348c", "comment": "Malware payload (AgentTesla)", "value": "52ae60735ad05bb9deb7f6d19da700e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255224, "uuid": "4013cdd0-d921-401a-be6f-54a252323cc6", "comment": "Malware payload (AgentTesla)", "value": "15e6b1e0ddaa38d6d989f6ded1f9c2a82a9200effaef975d5acfb705151dae3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255224, "uuid": "129ab9ca-0678-48bd-b5b9-9af0c416eb73", "comment": "Malware payload (AgentTesla)", "value": "348f5cedb81018497db2659f2e338591f13be99c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255224, "uuid": "10ff187f-cd5a-4acf-ac39-e19e306c385b", "comment": "Malware payload (AgentTesla)", "value": "15a151f5d0914af3464ff959b7b810889c55b52f695bebc3d37c0012eace05bd79103f0ee1d7a6dd30f1183faf1c794a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255224, "uuid": "62de466b-88ad-4003-a9b8-eb2cca3a1e4c", "value": "35358D1036D89A19F17BBBF899A4244187F9BE53B602D54D38B1328E0973B43CD9663F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255224, "uuid": "80f239d3-3a2b-4e64-a715-ba461c271213", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255224, "uuid": "a5e57872-4f5d-42a8-9659-d739a8de56de", "value": "24576:U+krxHxWw+4JHJuBy0a6RkdG09It0doq:UPLpu4U8+0do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255224, "uuid": "0275ca4a-be4f-4358-a847-e38bd61e0049", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255224, "uuid": "22078dba-2740-4572-835e-5cb66124804a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255224, "uuid": "1f2a1170-e13f-4b35-8e2c-c8ee0302b646", "value": "purchase items.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721e6eae-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624258435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258435, "uuid": "55c1535f-a506-4698-b6c2-43c7d7b31265", "comment": "Malware payload (Formbook)", "value": "587992b5d776469520bc415920f52599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258435, "uuid": "e0c7082d-14f2-4e87-ae51-86fbc9ce926e", "comment": "Malware payload (Formbook)", "value": "163b2e3a21095670e2b6b1c08bb66d1d46b25578bcd883ce0102b95a8dd6b5b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258435, "uuid": "90c1eec3-6f66-489d-b626-9bfe01966664", "comment": "Malware payload (Formbook)", "value": "bea600ad384c3025c058d08a3635fe1a8e1fcbdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258435, "uuid": "21607032-f0d3-4eb6-a532-976d6c1babdc", "comment": "Malware payload (Formbook)", "value": "d3fbf94baf6ea437668b96e3ff6cd372a6aca0f689cdb872deefd590de805efde84bc9ed2e5f3a2eebff1ffe8c2d1cbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258435, "uuid": "5512a749-0658-40e0-a01b-13ac824db622", "value": "17F4CF7039AE510DE577AF781AE436E29A7FBE637B07D85D24D0234A8723C428F41939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258435, "uuid": "22376ad2-df7e-4216-9b7c-8a89d34b3a47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258435, "uuid": "8b700711-ba49-49b4-96e3-2f519bc6e1de", "value": "12288:kVTbXWFHms07U6fQPOTEMZuIyymdJfnYE0gD3pttZfITrfmX7heg7SLJHhU:kpoHe1fQPSE6unY/gDfIPsegW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258435, "uuid": "9b3e059d-e8f0-437a-ab9b-421c25487f5a", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258435, "uuid": "accc447c-0221-4654-a64f-9ce178cd1eda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258435, "uuid": "5de91011-d182-4ad8-8da3-d832cbf42cc7", "value": "HALKBANK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b5eb62-d256-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624255319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255319, "uuid": "da94f24b-ff72-4dad-b1de-b567c076950c", "comment": "Malware payload (AgentTesla)", "value": "a1224527d43f4369e53427cc23d53830", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255319, "uuid": "d44a9bb0-ac18-4ae7-9ca2-e417d152f53a", "comment": "Malware payload (AgentTesla)", "value": "16687d1c2945be78cbcabfb542520fc4f0a153b820aed024d8dd0032be6a7b0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255319, "uuid": "9b407cf1-f6f6-4693-9130-49bb000ea32e", "comment": "Malware payload (AgentTesla)", "value": "567d6e382d8ec299bfbec98eaa0c1cc6b539c4e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255319, "uuid": "b9161618-88dd-4dd9-a52b-0ba20e11a2e8", "comment": "Malware payload (AgentTesla)", "value": "fc7daee8236104803b848201077b807ab2c60def22238a7dae80f6d4ed5ffe4547005e493c868b84b75532eb7811975c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255319, "uuid": "7d0f54e8-f493-42d6-a684-9181b8bdf247", "value": "ACF4BF2039EE510DE57BAF781AE436E2967FBE677B07985C24D4234A8723C42CF41939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255319, "uuid": "bb807cb9-cb8d-4b44-b11c-8eddb0bba710", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255319, "uuid": "4c57a8d6-d4e2-4d13-a4fe-b8fd40092260", "value": "12288:DxJ5DWFHmstLxEKiUBJHvJdmqtpzYEjLFdQh6xvqEjGJLWHhU:Dt8H3cEHvj5HC6BqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255319, "uuid": "02512c28-1162-49ec-acb9-9d9ee4f7314a", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255319, "uuid": "dd91ec35-eba8-4562-b74b-d8a7ce206af0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255319, "uuid": "24da6619-622e-4a89-95e5-b0ef23f8fc11", "value": "memorandum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6447be52-d2ec-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319830, "uuid": "b19f4caf-1e18-47bb-a455-a615a6eef048", "comment": "Malware payload (Mirai)", "value": "737b8ec2b391f48276693536a79638c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319830, "uuid": "67b2d888-5097-4f90-8bf6-7900f8e75b78", "comment": "Malware payload (Mirai)", "value": "16b6a2dd336ab8a36b8cfb0d7549575a7a2b2b79ad83b7456f7870989fbba87d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319830, "uuid": "f9b45626-5051-41b7-b0e2-4bd19fd9c020", "comment": "Malware payload (Mirai)", "value": "f17236b319d6a515e8134490a00833c4ef43e225", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319830, "uuid": "9806ebe0-5e5d-42d4-8391-a917a91ffc28", "comment": "Malware payload (Mirai)", "value": "ffb51d4b38d653795aec6b16ca7d8ce5d9fdfc53c5c82c623479babae0500aa122bafc24278fb1588eedb97d22e7db05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319830, "uuid": "bdca0f19-a79a-47df-b971-2008812a4611", "value": "1AD2E102EBFA5A9DE89910F213EBD72506709189BCD485F1B87021FF4859711B7323AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319830, "uuid": "3ea870a6-0f77-48fe-b75e-67d122f30560", "value": "768:duH5tyEYkO4uhxG6O0nO+qlbmRH/eruoZd0z0S0/6NanbcuyD7UHQRjH:UZIEYt4uhI6jnONlyRGFZ60lpnouy8H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319830, "uuid": "ba80115c-c044-4448-827c-d3b8f14e5540", "value": 30880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319830, "uuid": "4b72b7b4-926c-47a6-b547-05b9ac5890f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319830, "uuid": "8da2b3b2-e614-4f4a-850e-66c10e7ff8d3", "value": "737b8ec2b391f48276693536a79638c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5feaa7e0-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284174, "uuid": "9600e1d3-8aee-4442-8634-a9e1a451e559", "comment": "Malware payload (Gafgyt)", "value": "630cf34f4b55f4f40acd5bb26fd2e58a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284174, "uuid": "3fd0742c-5c8b-4563-8ede-e087615a5397", "comment": "Malware payload (Gafgyt)", "value": "16d966c24ef9c96e5ca6cba23639a514532a5945d6bff78cbd75078c9fda6e99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284174, "uuid": "bd1e1a85-460e-44f8-b15d-a795b4f33d69", "comment": "Malware payload (Gafgyt)", "value": "b159459d8804eeaf88f47988be98d0267b219d42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284174, "uuid": "e04c1605-8c63-4b59-a31c-d3aba3024077", "comment": "Malware payload (Gafgyt)", "value": "4d94fdd56507c7722492a21f9800cb3fc771c688c0356bed04dc615162d04c6703e19eca48e82754ae3cd2ed07b637dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284174, "uuid": "bef4752d-aff3-4dc3-bb29-959d895da02e", "value": "B6C3C517AB61DEB7C81ECE7306AA460110CDE45A12E97B6FB274D96CE74B84F08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284174, "uuid": "eeaeafa3-d7e5-4a0a-8e2d-11fd83826cfe", "value": "1536:C5veeTTmLpfkdWFPUymtAtZSrU7jHfesge1AP077sMkj/ZkkRx9Z/5RJSSdom:YcPUetIJWtstkkRx9Z/5RkSdom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284174, "uuid": "a14cf56e-8769-4efd-822e-b4abf84fd4f9", "value": 123171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284174, "uuid": "3c4986b5-60db-4487-9ce2-bb49e0973b99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284174, "uuid": "8a687cd0-7032-4a7b-adfb-a612059c4ec7", "value": "630cf34f4b55f4f40acd5bb26fd2e58a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d362261b-d28f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624280073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280073, "uuid": "005255cc-cbab-4f6c-b8bc-f5eb70f4640d", "comment": "Malware payload (SnakeKeylogger)", "value": "907f6f10618c850c199be5c9b37e3448", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280073, "uuid": "69b07330-bf48-42bc-a580-8ee4898436b9", "comment": "Malware payload (SnakeKeylogger)", "value": "16f002ec4f9c8793946d9f5059e0779053109851a7f91438953c9b2abbb4bfff", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280073, "uuid": "7c49d1d9-748d-4c4d-9c04-e4607bdc3640", "comment": "Malware payload (SnakeKeylogger)", "value": "6705592a7a8d7cf596f242a2006ae437bb36fa5a", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280073, "uuid": "f47e6587-14ff-4075-ae8d-8f8bdc457fed", "comment": "Malware payload (SnakeKeylogger)", "value": "640c9e0cf03ee4a7bb6dabef29f6b320a74edf2083184856a258981a3019d8e3703f78369d4511ebdcbce03da72cad4a", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280073, "uuid": "68a7f48b-8f56-40e1-9b4e-566bc01eab22", "value": "9AC423AA1392A07991615C3501A37E70DD2A6AFFEFA835D4C3EF2C5B564FD0336C4828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280073, "uuid": "33b56a08-55bf-4670-8191-105a319ee7be", "value": "12288:HXB0esJ0bSjS1sSPSVs2i+k4XXgUh55xKhuxb/oiIHWOAZ6U:H0BSj3FJ4gUDLfOiI2OAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280073, "uuid": "b95c151e-e649-471d-9f4b-0109c86177c4", "value": 580352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280073, "uuid": "faa80cdd-f942-4ea3-a77c-bf18fb2ea1ab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280073, "uuid": "363da439-4738-41e4-836f-b59a2a34458f", "value": "Minutes of Meeting.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999a843c-d263-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624261078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261078, "uuid": "e42edb58-6449-4a3e-b62a-925d524a9991", "comment": "Malware payload (AgentTesla)", "value": "49cbc3d93b340d7fd363a04af9eb47e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261078, "uuid": "6d829b03-fb06-4042-92b0-98eb80f35076", "comment": "Malware payload (AgentTesla)", "value": "17143eb0ac72237157015c82aea83c0d16f94df25478110f25651089185ba9bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261078, "uuid": "f1b7a79d-777d-4804-9b98-b3ecec3e30bc", "comment": "Malware payload (AgentTesla)", "value": "7cbca7087fffd4a27c1a691c866e020ed7bd81a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261078, "uuid": "4143ec3c-de46-4815-94cb-f8ebb4843745", "comment": "Malware payload (AgentTesla)", "value": "587196376da5a4adeea36c3f8c70c085c7ff215715e2b77b4b6d9ca2f8a431ca6342ef610b95c6bc028e640fc1f39929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261078, "uuid": "56082844-36a9-4d33-b300-73774bd3ba89", "value": "0B257DE1B194849EF87B4AF17D7A753024A7BE9DA594800C15ED370B67B3342209FE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261078, "uuid": "11737629-f6a3-4b01-aac3-9dbcbdb97dde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261078, "uuid": "69f8fe83-c967-4fa2-877d-73f4dfc9b97d", "value": "12288:Eh525WFHmsDhQr9qrhTCepCnVWgRj21IT+caqjIZzsdyPHyHhU:E2+HxhQ9kCeQnVtE1ITlaXZzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624261078, "uuid": "0dc1ce9f-0f23-4c2a-a0ca-408a434d381b", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624261078, "uuid": "f4c900b9-ea36-4f65-b9a2-5d22e75c5f8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261078, "uuid": "8a27d56c-0100-45d9-a5cb-fc0e9089b3d0", "value": "49cbc3d93b340d7fd363a04af9eb47e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c74b5f-d263-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624260912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624260912, "uuid": "3b3c3f10-d162-451a-9158-e72e0ecd3810", "comment": "Malware payload (GuLoader)", "value": "789a47d33ce65dad5fd40c1e656cf638", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624260912, "uuid": "96727113-2f04-4d3e-9616-24c656a0ae29", "comment": "Malware payload (GuLoader)", "value": "17dddb2e6db0aa7d67c0e63f1129dde91f471fb6c5ce41d1e1574d8403ecd1ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624260912, "uuid": "13849b6f-ac27-443b-a932-43858ef56605", "comment": "Malware payload (GuLoader)", "value": "4b6c5fc8230797fb521083601bd70cd83d8c7d2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624260912, "uuid": "cec56282-8ce2-49a0-8ac4-de3996f519c6", "comment": "Malware payload (GuLoader)", "value": "ff7b4c79ae016ab9bc09f3d88fb4e40e53cceba54995950536de71eadc0cd590e32a0872b0dec14c5cf0f6e6b40451fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624260912, "uuid": "0b5dd2b6-ff4d-4a69-9c4a-404910a3d412", "value": "18936B22FFA4D891E04689724FA398B11A11FC26E8118D177179BBDD1F347825CE7F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624260912, "uuid": "6ed88a36-b0d9-498e-bfe3-21b4365771a2", "value": "afebd4b9a3c7e2a05199a96fc7d3e5d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624260912, "uuid": "83517553-2dfd-4f36-a69a-bb196b7402d7", "value": "768:bOBYycoRhQqLpQ5PiRvwgo87goAub5sIE6uN2+JG39BztoLou6THw4tM+y9GFzyB:0zjCoOPiugp3AsQN2RTiku6TQrt9uWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624260912, "uuid": "184399e8-2fcc-4a46-924a-853c2ae1130c", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624260912, "uuid": "90f38891-3f0b-4b21-9217-25368ad74aff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624260912, "uuid": "b6a58e7f-e2d7-4412-bb75-5e76069728dc", "value": "789a47d33ce65dad5fd40c1e656cf638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4050d46-d26e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624265954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265954, "uuid": "57dded3a-7769-49ea-98f1-7a3c6360c41f", "comment": "Malware payload (RedLineStealer)", "value": "ff2e018b080dce69282bb1d040b0917e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265954, "uuid": "5d6ef412-1663-4aa6-bb7e-01cb0c802142", "comment": "Malware payload (RedLineStealer)", "value": "17ec626960cc18f96be98ce637dccadd511388c8399ca92a86f928f1cb314bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265954, "uuid": "9e4d1bac-ac5f-4525-881b-07aacbd690b0", "comment": "Malware payload (RedLineStealer)", "value": "4a41bfafe66830168abccc9580cc6eeeefb2af55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265954, "uuid": "c83b9bea-d2a5-435d-8274-bc6a252d6826", "comment": "Malware payload (RedLineStealer)", "value": "3c556d377ba128ccb541e60af30281a1498e6dad4ef36889997c0ea617024c755e63e128530a40082e0e6cf6c1ea67bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265954, "uuid": "43d07b8d-56e8-42db-bb91-c79acc833023", "value": "7DE4E110BA92C035F6F791F845BA9368653E7EE1AB2860CF12D516DE1A747E1EC32313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265954, "uuid": "5fdafcc4-3c25-4c49-b4a8-9507e997201f", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265954, "uuid": "10205437-b996-488f-a01d-ddd16dd61679", "value": "12288:UCFUDxyHjtba+v22j7XIJYIZkEtYeHYoF0oqbDq3xy74CFHalZ:URDxyHj99XOXkEt9YFoQqs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624265954, "uuid": "45d2b9b2-db7b-4c28-9487-ec703ee24a1d", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624265954, "uuid": "833559a3-872f-4b5d-9555-4e9b7376ab13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265954, "uuid": "1febcc3a-afe2-4db7-9731-286782cc4752", "value": "ff2e018b080dce69282bb1d040b0917e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ddfb8a-d26e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624265910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265910, "uuid": "42db000c-11ba-4efd-ae32-f910a8071782", "comment": "Malware payload (NanoCore)", "value": "937d822a52ce1942bd2de9f951fb42eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265910, "uuid": "999e63f5-8e62-4619-b69d-8cca3dded606", "comment": "Malware payload (NanoCore)", "value": "1831edf206679003e2d0ecf2c151c075a6cd527f6dd3e0c8d075e3a5e8623165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265910, "uuid": "1b04b0ea-f02a-4658-9be6-0401b7315c8d", "comment": "Malware payload (NanoCore)", "value": "bcec1d917228279938c19e7055b3f9520627ce6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265910, "uuid": "d36625ee-b634-4f6f-9477-2a1cf799f859", "comment": "Malware payload (NanoCore)", "value": "c0da146f4efe0ef528448036a8d5372af60561521949d11954423f851694952b907f5352aa1668761b43b981d53051af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265910, "uuid": "7218b912-a420-4e22-8d84-a4d40ca6d388", "value": "5A3512A0715E620EDD9D40B82D2637F056B76DD7FB46DA9C3CE8314AEBA78C60700A74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265910, "uuid": "d272a9e8-a4b9-45ad-919e-775b69236eea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265910, "uuid": "5f5c1ce9-5c6d-4046-a907-141030a50d0f", "value": "24576:X5aA4ozMnSvFszk4v9ip++qS/rTvHXf0o:1zMeszBVEFqODHXMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624265910, "uuid": "66bac6ff-5c24-4c5d-a28b-bd73d7eef317", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624265910, "uuid": "4e56e059-cb72-4eba-b24e-7b1c28aaa956", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265910, "uuid": "3eb8b7df-8470-410f-9277-aefacc024c64", "value": "937d822a52ce1942bd2de9f951fb42eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fae59bf-d259-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624256766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256766, "uuid": "9c81220e-2838-4edd-8385-6c35dcfe5e0c", "comment": "Malware payload (AsyncRAT)", "value": "16d64f89a95c120697e0d650604b7f73", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256766, "uuid": "a0470e46-e494-4a75-987b-89dd5b3788fa", "comment": "Malware payload (AsyncRAT)", "value": "195720af312d3a17dbd3e4fc35d8e8a68eda1a9800d722d772b4f62704606348", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256766, "uuid": "e303f986-edf3-4fd2-943f-4f3603b4d9e6", "comment": "Malware payload (AsyncRAT)", "value": "2734e185ea28602d3b24afd88d693ac333ebd46d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256766, "uuid": "0009538b-c9a3-40f5-914c-82d7b787e888", "comment": "Malware payload (AsyncRAT)", "value": "4df494c6dc90b0a135f12b64b55fe0c04926493d4fee926056f601ad72fc3c987fc341009ba1d7869c6c1efd1aeac15c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256766, "uuid": "8ee68dc0-301e-4e85-8e39-ed091b556476", "value": "43E02B6784898C5412053B9E6D4FDC84FAC0019C37F4E65E3515D881F628AB01E1C0C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256766, "uuid": "03e3f761-00fa-4792-9e0f-a238792eae7e", "value": "6:KqsuM7fiZqO/DTBKymFAJvErEoJpjLovsE0DefB1qW6Ja1Om:cuQYVdKPwcre6+6Jawm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624256766, "uuid": "03026669-95cb-4184-bf8a-c74927c03aef", "value": 294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624256766, "uuid": "0846af0b-141b-46d5-9f4e-bb39ad29c6f8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256766, "uuid": "a2259aa0-2be4-4fc7-b577-b46294cc0606", "value": "20-JuneStatement-2021ID67641313727902.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e30514a-d28e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624279339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279339, "uuid": "6a0bf4d0-65f3-43db-9851-876416222bc0", "comment": "Malware payload (AgentTesla)", "value": "eca7eff25c6f5bd7ca81373d56c3cd94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279339, "uuid": "21721a8e-1173-4b88-872a-011556f4d161", "comment": "Malware payload (AgentTesla)", "value": "19f512ee634d2d47156551904a25f5b650083c60a536079c11c512edd6914c17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279339, "uuid": "3e7ccae2-7103-468d-8ec1-a2920a372933", "comment": "Malware payload (AgentTesla)", "value": "15869f1a89e224cf74bcf4356545268c5b5fd47c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279339, "uuid": "2506686f-815b-48c4-a0a7-a3381b3ae8ee", "comment": "Malware payload (AgentTesla)", "value": "3bc06b86655827a7a99eadf4dd6d7160d765741fa4b4a3c7dec7b569a2d7b4aacc3cb0faf5a7027fff07dfceef0744c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279339, "uuid": "96054131-b5e3-43fd-b8c8-aeb41c3c085b", "value": "19F4CF3039AE510DF57BAB781AE436E2967F7E677B07D95C24D4234A8B23842CF40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279339, "uuid": "300b6c8b-1762-4b2b-b14d-0bc0e9e95ac3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279339, "uuid": "de33949a-c4ba-4459-97a5-7c41879a89ee", "value": "12288:MdKf7WFHmskaldxnp6GUvLOqdWCLipHV2qrfbFwMSJsdHGZxHDwvQ+HhU:M0EH6QnCL1wCLipZ5w+ojw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624279339, "uuid": "a3336e6b-0770-4971-b3b4-4f04dab80140", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624279339, "uuid": "dd2f9ff9-10aa-4cee-9e73-ed7e120e030b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279339, "uuid": "fe4e12e4-73e8-45ae-ac67-971d386e5e10", "value": "Copy of DHL export doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1731e57d-d252-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624253558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253558, "uuid": "6f9a3ac9-13c4-4a9e-9a7f-47946c2c39ab", "comment": "Malware payload (Formbook)", "value": "e4a03cb4632f58a3fa14d2775d141e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253558, "uuid": "2948cc76-6f96-4fa8-a2bf-e7692fee3f27", "comment": "Malware payload (Formbook)", "value": "1b7b0ee9811587f5a4402008e994f9da8eecca2d61c2818c2747662b88697928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253558, "uuid": "dcd69be2-d2c9-4e38-8963-6ee9a51756cd", "comment": "Malware payload (Formbook)", "value": "11c6ce89001e952a024e18ef35ce62c1b9e69b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253558, "uuid": "f5b8fbac-27f8-4d4f-8f3b-717076bdf80d", "comment": "Malware payload (Formbook)", "value": "7d8d3041b7488a70dcda91b5af58fe64571b70151b64f82f934158e3172cab9ed04e9f67041197edcd449118b3208033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253558, "uuid": "54819424-5db6-4fda-87fd-ed40c80382fb", "value": "A115CF5031CAD44DE0336EB119EEA5B0957E7E9FA706C90D3682370B97A37032A56B3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253558, "uuid": "002078d2-0a53-4ac1-a2c5-7d1e496b5e90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253558, "uuid": "e10e066a-eb7d-4334-9665-d0cc9f8376cc", "value": "12288:9StmWFHmstvxBCXlNWW+ksNjbWu+1lsUal0vEuKgh4NBog6INHhUiSiyyjK:9KVHDJBIzWYsNjb34sl0vEusNTVd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624253558, "uuid": "9d76d51b-dcc9-4d5e-a96d-4c11fd27ec34", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624253558, "uuid": "47c2b96f-822e-45c2-a7b9-22662659b312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253558, "uuid": "5502f1d3-1f52-4e63-87ef-28ac0e92a13b", "value": "INQUIRY.ZIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7e6e9b-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315253, "uuid": "58114ae7-a3aa-45dd-8ead-55d34f237105", "comment": "Malware payload", "value": "4f63f831f0cc6ccf353e1a6bc39440c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315253, "uuid": "23fc679c-2afb-4ea0-ae27-e67ddfa69417", "comment": "Malware payload", "value": "1b9995b4d1ef90b4b1db62b8db973db8e7a88be66df0c77a66d5a1198dfe1487", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315253, "uuid": "6dd19489-f6fb-4247-8f14-20666a49d153", "comment": "Malware payload", "value": "b8b9e5a02f3ad81913f6d950bfbfcedee26d128e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315253, "uuid": "af3b22ff-0f98-49be-ab6a-0bdf7517d476", "comment": "Malware payload", "value": "d8eb1622a18b677f917cec42ba6aa892d34f7a5e93f994e87f95e06600f423c158bcea489fcd129bda663240e9e2a124", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315253, "uuid": "12b65142-e5be-4786-b149-e66510275b3d", "value": "44148C447080C57FEBB70237C4BBB73A63FBA2942734D8C7DB885D896465A42E726643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315253, "uuid": "6f99e779-07c7-4888-9894-baf43f0ba276", "value": "59a07f90a12b6534fc49375f47060d12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315253, "uuid": "ce5d3992-7119-4d3f-9d48-dc24008fddf1", "value": "3072:bDSzMKZQdQEf9+39CALhSOjHOPUZTaznTy0ZEznFBvw3BQZcsHR4wJ+Hg5VXfoUL:beoKZwT9+38AL8OCwaTTRWACHRTJ+Hi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315253, "uuid": "a1111083-8da5-4797-8f39-f865b16d5256", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315253, "uuid": "a222526d-3172-4746-a67f-72833a0c2809", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315253, "uuid": "33c0353b-17b7-42c1-b5f7-4c99dfff1a03", "value": "payload_1b9995b4d1ef90b4b1db62b8db973db8e7a88be66df0c77a66d5a1198dfe1487.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8dd0767-d2e2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315650, "uuid": "1f93260d-eea7-40ac-ad3b-770804efdbd1", "comment": "Malware payload", "value": "aaa27cbfe3996c456496c23a732afe8f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315650, "uuid": "91422d0b-c485-40fb-8443-0e9b33cc0743", "comment": "Malware payload", "value": "1c02cc7732875118e406908b920239c7aee694ba0f3e93b1615e7eddc6d08841", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315650, "uuid": "03cdce02-3690-4b5a-9ccb-a93ab40d2b48", "comment": "Malware payload", "value": "1de4b101634847dabd818a32bb6cee15a06d5912", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315650, "uuid": "a8944cb8-e86f-42e4-8a66-92d978448516", "comment": "Malware payload", "value": "786a63343d7ccd05e759ace66d4a76faed3961ae7595e7a244d20c04cc0766e2023037f695fb2714aa9abceaf542aa1c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315650, "uuid": "93d49d28-8e94-4adb-b96a-4a47778a72a1", "value": "4404D01FEAD706CDE337AA333A5D732B62C45612DF19D0A8CE14D2FBC1B14904681A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315650, "uuid": "4cf101ff-a4b8-4d6b-8a39-24eb70a122c5", "value": "b380277cbb8ae5571489cb34552d83fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315650, "uuid": "551db19d-44ef-47d4-8fb4-e857cc77b75a", "value": "3072:CuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:+zWxkOP4p2EesvcDi6DOHPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315650, "uuid": "51cf5909-f628-470e-b766-6778587db7bd", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315650, "uuid": "1b73f239-b78d-409a-82fe-747718073ea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315650, "uuid": "779315ff-0965-4a0f-97ab-572966c1047a", "value": "hVgDOoWFtxl4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1fc3b3-d231-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624239691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239691, "uuid": "21c388b2-6bbb-404c-8d97-a1efccedad47", "comment": "Malware payload (Mirai)", "value": "6a6808a9fccc3f133e5e7742162e57da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239691, "uuid": "3637f412-4a9b-4d1a-a201-f618297fa018", "comment": "Malware payload (Mirai)", "value": "1d5ccc4f25d35bcaf79531ab8ab75b0bb7d7974e05f9e22267ddc26dc0fe0a06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239691, "uuid": "39b9688f-def3-4cf1-be39-ba999992aa81", "comment": "Malware payload (Mirai)", "value": "925e9fe5e3f24d0a559271e40f16ea33d9d3c493", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239691, "uuid": "cf7acf24-1ee0-4c05-ac4b-6d8e1d3fd7de", "comment": "Malware payload (Mirai)", "value": "73f4eac6927e54da2d68cc2d8e107eafb929c0dea96f7e9577adbf8d71e5027b6ebf75e92833bd9e8bb135ad3bfbec2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239691, "uuid": "1d6fc866-f787-41b1-a491-ff53a3450117", "value": "1B04C56E3E21AFBFE668863107F35F70C39921D226A1D382E26CD6185E7118C5C9F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239691, "uuid": "819ba888-47a6-4c97-b712-6667104dc641", "value": "3072:HYpACiBYHfCJZ6s5qHtu1+GS5xScrv+yfwsMHURgDDq4B11IuaYB:4q+FNNxzrGyVfgDDq4B11IuaYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239691, "uuid": "60679336-1be5-402c-a379-e4bd47702d7c", "value": 187032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239691, "uuid": "2a693092-1b98-497c-85b5-946ed15ba8ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239691, "uuid": "e4246fb4-2ba2-4d3b-871e-0601faf488e5", "value": "6a6808a9fccc3f133e5e7742162e57da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca23a202-d2eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319571, "uuid": "fd2600ca-17ff-44dd-8f04-1a37a8cb0eb8", "comment": "Malware payload (Mirai)", "value": "6eda336424c6de578742fef54077361d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319571, "uuid": "c8464ace-e7f1-466b-983b-d2bc70c2ec37", "comment": "Malware payload (Mirai)", "value": "1d7d76f9584a7b50d52773682f19cf0871e3b706e27cb4807d3bb097d79e18f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319571, "uuid": "bee74192-67f6-497a-85eb-ef823d5e5381", "comment": "Malware payload (Mirai)", "value": "7f998c11f92eb2bf88c3fa0ca05467c2110cfc0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319571, "uuid": "ba235119-5293-43d3-8a78-f360a3dee8a1", "comment": "Malware payload (Mirai)", "value": "c1bbdcf740db83090819db7ac98302dd87da84f630640938bdade23d875bd8491b7ef6fa4110fa596a72338e5f2b2afb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319571, "uuid": "54e90966-de83-4eb5-95c2-8ac69895176d", "value": "37D2E1B8D5204A87EBF7DFB1EDC082A177B01F0A7B5642A251D7EA210B47117312DEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319571, "uuid": "113305cd-1e7e-4c7e-831c-39db682d51ae", "value": "768:EbA9JpZrXVBnr8kw94UIwotDwW/ijyE4uVcqgw09N:OA9bZrlBr8kw944ZVjyE4u+qgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319571, "uuid": "514b506d-124c-4901-a311-1da236cce9d3", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319571, "uuid": "965b301e-ec82-4f5b-92b6-5e86acb3b92d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319571, "uuid": "8c77d288-700a-49ff-83a4-0a5037d72b2b", "value": "6eda336424c6de578742fef54077361d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01231a29-d286-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624275855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275855, "uuid": "8ec74fb6-2c20-4379-b9aa-919b1f699041", "comment": "Malware payload", "value": "3784f45911e5a27293cb470ce642e017", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275855, "uuid": "e16f2e76-3d77-4cd8-aa91-031df820bf88", "comment": "Malware payload", "value": "1ef744cce1aa8504c6e57067f6d2eb92c1e89707eb1964b7e338fb19684d5617", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275855, "uuid": "82490539-8915-495f-b2bc-61f59b143499", "comment": "Malware payload", "value": "b86e4daec2b0cf8b36ab0e417e9a490290792daa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275855, "uuid": "0000b822-d2a4-400f-9193-681f27b75a16", "comment": "Malware payload", "value": "094bd3660a8e76779875ba6ae223eb7b939c4ccb62733cefbcbd77f52778ad91aa7fc0761df6a1eba6cc0fe74b7aeb71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275855, "uuid": "4ece5d11-75dd-4a52-9b61-8cce809daebf", "value": "09452341B288D065F5ED0B7258FB8B7B1D763C812C64C71EA3A4FF4D29A3631A617A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275855, "uuid": "1a97aac5-81b4-40f5-8bf9-2ec4b8e639a5", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275855, "uuid": "769e38f7-1f13-4b72-85a7-f6fd35cbee15", "value": "24576:mM/P1ZZSwSfLhEx3CMRJj7T+/8r3zlH/gsGPlS/RhQifbE:1P1ZZ7x3l7TU8rjlYK4gE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624275855, "uuid": "0a4246e6-df96-431a-8659-b2f47f5486fc", "value": 1251256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624275855, "uuid": "07da58f2-6ecf-4f3b-bbbb-2e6719ba997e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275855, "uuid": "d02e2016-84f6-46d0-8ada-ef0cf041bca4", "value": "3784f45911e5a27293cb470ce642e017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d74ae21-d290-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624280197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280197, "uuid": "3cd918c3-40fc-4a90-8d48-9da65d07cd22", "comment": "Malware payload (AgentTesla)", "value": "25d82f8e473c1d2a4a36425570d1c532", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280197, "uuid": "e84fd961-7548-478e-8e75-fecdd571fb92", "comment": "Malware payload (AgentTesla)", "value": "1f5d4e631451efb5fc263a2bc7a537746791ae4345180147f44598a0d6293d0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280197, "uuid": "094ad44d-c194-4570-b325-97bbe7705660", "comment": "Malware payload (AgentTesla)", "value": "60efcac6c44d3ed14ce81ee9938a2d310fac01b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280197, "uuid": "ffe5f56b-f11a-4965-b5ea-e908454a6db6", "comment": "Malware payload (AgentTesla)", "value": "18245250d3a36b999d072d66c5238f26a8934089a4ffc87cf21a0751f650a74babb4a3466dd9f5d1d305910437fe21d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280197, "uuid": "6c413906-f498-4680-9d3a-c1a9e1e3300d", "value": "E7D423C6B70B6E9C42024ED492CA1313458CCCC9A35C646B5964B64E3C76D21FEEFF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280197, "uuid": "a5ae0aff-d73e-4eec-a0b8-0b5f786e6854", "value": "12288:qE6azMGf7c2LB2At7fqJailhxEEfkIS7zKsqYbepgD/oL+lFhSe9MEAsKQiJKZio:qMzMsc2V97yVF8PrqYggDwafce9VAbKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280197, "uuid": "4353bfcb-531e-4bab-af0c-0f3c8bacf3b6", "value": 621355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280197, "uuid": "462baef6-09c6-42e3-b96f-6b6c19f590c0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280197, "uuid": "25e163f8-6510-4202-a580-4a29bd76174e", "value": "QUOTATION Q 01668-R1 - 4KW.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab502d2-d29e-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624286420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286420, "uuid": "1a6d37ff-43ec-4e6a-b0a4-5e48cbea181a", "comment": "Malware payload (DCRat)", "value": "ed0551481fa342d10d1513feaeaa07f1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286420, "uuid": "1ae771d3-875a-4a77-9431-6d64027abcf7", "comment": "Malware payload (DCRat)", "value": "1fc3e401a27c81159ca6515bf7746bcb78c20e5ad33d2922f4713ab4635d75b1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286420, "uuid": "6a4d26bb-ac8b-4fd6-bf30-c337532896fa", "comment": "Malware payload (DCRat)", "value": "a7c1effe9f14d07d03d55285896d9ef1c8af62c6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286420, "uuid": "9cffcaa8-b0e2-48f6-a7ab-5e784e64572e", "comment": "Malware payload (DCRat)", "value": "34f4eac18587ea93144fc2415b949b384293e927362399dbc7c499b62cd7c320289925634f28f6c3b9ec7f4827b93138", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286420, "uuid": "5a0f8617-39f4-4597-88f7-052b4b8982a6", "value": "0E4538023A4ADE02D069263BC9EF847807B8AD417B66D71A7EAF335D64113E71D0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286420, "uuid": "8692cbc7-2664-4c65-b38a-8e732a08abce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286420, "uuid": "9499895f-9fd5-4821-bac9-6d8a5d5e28e6", "value": "24576:OwcL3W+fU/huXXEnr9rMDgol64sdU2Pa8hEPRPu56uXkvGb/q+4:OVXEDolcimXk+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624286420, "uuid": "e5825530-852c-401b-a644-a856656273a6", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624286420, "uuid": "376e6987-6f44-434c-8747-e6694cccc885", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286420, "uuid": "a73e849e-49ee-4a0e-87cd-ae42bac8f53d", "value": "ED0551481FA342D10D1513FEAEAA07F1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ab505b-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303165, "uuid": "67bacf85-2ae5-4ca7-9739-432760cef5de", "comment": "Malware payload", "value": "3dd2297f1d821ceda7aca78702b1f4a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303165, "uuid": "69cd381f-6c21-4196-9ada-42e2d8d602b7", "comment": "Malware payload", "value": "1fc80ed2a0dc682d7bbee1f5d7ec1c1c49fce2b6a9829e46433018d97a4c178a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303165, "uuid": "b21d56c6-718f-4073-b1f8-7d2208b7ed23", "comment": "Malware payload", "value": "529a661e62b3664b9355e4332cf5ae32daa13c07", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303165, "uuid": "2e0c251a-2dfc-4e19-9e09-9510fd0d0f97", "comment": "Malware payload", "value": "2f163e043600c0858f3d461840b78d5469085e20241a79d0f84017488b702ee57f77f2eaccdc513271da6c687dbce347", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303165, "uuid": "688e5c3c-f133-4688-8508-e41fa32b1c43", "value": "B233C054F101DC60DF1EED78A5BA60B076AB0AB4F390AC936C80925D59B106DCF3B7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303165, "uuid": "18bfdc4d-3b2e-4f69-8c00-a7ce7ddd088b", "value": "1536:/5DSIQIOf7SieU6ZDvxjxcpAr/USvhWyUl8:/kIWSiebvxju4/UchWlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303165, "uuid": "5f6332fb-cb21-4132-9174-aec2eb68e92a", "value": 51347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303165, "uuid": "7992e5ff-b414-4ce0-9eac-ed6d37682a75", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303165, "uuid": "c7841f62-2784-4977-baf8-034a2bf2cf37", "value": "input.06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f25b1fb-d263-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624261087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261087, "uuid": "01fa87d9-bc67-4914-a8a9-f02e0a78bb30", "comment": "Malware payload (Loki)", "value": "71d9192b48e107bd80acfe356678d629", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261087, "uuid": "324bc275-d53a-47f1-9f06-f922ffeaee53", "comment": "Malware payload (Loki)", "value": "213263b19fc6d0fb989665f518de523dcc8021be36f94b880056523a4a4f4566", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261087, "uuid": "aceaae17-54c7-49e6-b22e-60d211ac3868", "comment": "Malware payload (Loki)", "value": "a2ec863cc82c10701938f0c07a500a93fb8463cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261087, "uuid": "5b608631-8faf-4c56-bb15-090062ebf49c", "comment": "Malware payload (Loki)", "value": "3661b05c81b273a89a4a3fa48cbf1a7889af053b9aef35b177d6f9f7826324a1893d783607e642c2e176b895c0b9905a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261087, "uuid": "f9b7884d-3d17-403c-9c57-657ee120e5f5", "value": "45E4BF3039EE920DF577AF781AE436E2966F7E577B07D95C24E4234A4B23902CB40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261087, "uuid": "76bf6172-1d44-431b-80ac-bfe06ea005c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261087, "uuid": "d3c4ac35-ec4b-4314-8a39-6d6862d533ea", "value": "12288:343yYYT7WFHms1VxbwYmLBi8i8E4E2Hen0JsRgbzCjsNHhU:36mEHLVmL1i/Fm0AsSbOjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624261087, "uuid": "a455d115-4e3c-488b-8322-3bf6220649f0", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624261087, "uuid": "08386e4f-68ad-4f50-a3be-852cc5666446", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261087, "uuid": "3da9136c-f587-4f26-9d3d-582b1f650b9e", "value": "71d9192b48e107bd80acfe356678d629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b94d35-d24e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624252072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252072, "uuid": "c76e3c5f-e20c-4449-9e8e-1aed9ecc84c1", "comment": "Malware payload (Formbook)", "value": "c903aff4320e5f0288f9677d97fea15c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252072, "uuid": "ed9a2b32-3f89-419d-bd58-bd7b39d3b241", "comment": "Malware payload (Formbook)", "value": "21b29b3e6e8ea1f94e0d6944026efdccf89b7f35794478daccd05e2a00f222cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252072, "uuid": "0398e3b8-8e2d-47e6-90df-b78f2e9618bc", "comment": "Malware payload (Formbook)", "value": "8167161c2befafa063e1bc868112b7bbaa1e9ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252072, "uuid": "e176b601-0bb6-4e4e-b535-2f73685a84ca", "comment": "Malware payload (Formbook)", "value": "32da857fd8549e8849f5fb01cef36df879a1aeba8ed79059481662e4023e8b38f82c8af10523c3cd8029fa2d42f5777c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252072, "uuid": "e01506b6-fed7-4370-836d-4d239551e62a", "value": "1BF47CAC3190B5EECA2BCE76CAA82C64AA247473531BD207911705DD9A0DBD7DF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252072, "uuid": "c57002dc-4246-47cb-ad82-7ac8db98b5a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252072, "uuid": "fc09bf55-de51-43a0-95cd-db47a08920b8", "value": "12288:wWmIoCIMNOD8Nz9XF71eTnB8pc2VXdaNApeD05oGOWQ6e2bLiA8nfX3N7kfpdfJT:5rtNO4dOBj2rCApea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624252072, "uuid": "24fb61c0-f892-4169-b88a-91028a1728d0", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624252072, "uuid": "2da9d623-6428-4811-8c5d-bad24fd3e02e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252072, "uuid": "f84d4375-2f74-4663-b3e5-072e9c591ccb", "value": "QUOTATIO 00434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6a9c55-d29e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624286582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286582, "uuid": "df143f9e-0bfa-4bae-a77f-6a603ea5a508", "comment": "Malware payload (NanoCore)", "value": "9cd144104a3b4ec7fd5ff2e96f53efd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286582, "uuid": "6d71edca-b912-49bc-9eb4-8a914301ba92", "comment": "Malware payload (NanoCore)", "value": "21b7c1c49712d326c41dcdf85a665acf4845aa9616ab18ed3d51fe9fe28a5729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286582, "uuid": "0a3272c2-27cd-460c-864d-59a58751b796", "comment": "Malware payload (NanoCore)", "value": "54b97c3883ccc67c44d8b6997109266dbdb8095b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286582, "uuid": "06c9c169-d1ff-4fe8-85cc-7af66d140cec", "comment": "Malware payload (NanoCore)", "value": "77939df788102cfb59f0b3342ddbd6d878b2d357db2c582cd169f5ec83cd4fc5c0e30c47a358f2b63424c7db6d39c8fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286582, "uuid": "f41ee504-94a3-4770-8b9e-755fcb0434c4", "value": "4EC4F13879EA4325E5BA9FF869B0A19147BAB2363503F25D0DD120DB4A63F40CE51F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286582, "uuid": "8d859015-20f6-4924-80a3-d70176008448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286582, "uuid": "62f0a43f-d27b-4ab9-9523-1b7cfcabe416", "value": "12288:XKoVqoOZvvXJwWKRhU3JPTzwY/ZBzoL5d82S+:XTshRwWKjU1zH/bzo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624286582, "uuid": "b2567155-d293-4e6d-b76b-3f04109985c4", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624286582, "uuid": "6a890a3f-c72e-4532-b518-846bc127d1b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286582, "uuid": "08210305-1b71-4d39-93e6-9eb1f6cb8b02", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e28e8f-d29a-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284718, "uuid": "0f2cec91-9f53-4ab2-8845-dbb16449150b", "comment": "Malware payload (Gafgyt)", "value": "aea9076cc06c2dba15e21347b8eeafa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284718, "uuid": "b28e4154-6917-4a58-8596-a29410509a53", "comment": "Malware payload (Gafgyt)", "value": "2217c684a7ea774f2151bc298eb35dc74e55165fb01131155846ba84f1f6210f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284718, "uuid": "4547a6ef-a870-450b-bea8-e3c399db18bf", "comment": "Malware payload (Gafgyt)", "value": "4dbf1c8fbfd4837b87d232425887434ea788fd09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284718, "uuid": "890c5e88-2f9f-4829-a58c-2b4424b01e95", "comment": "Malware payload (Gafgyt)", "value": "d57e1573667b406092780f49507fcc51a525edc781d2fcb69823d87cb9552b7cc89a1c73d1220c1337fed84e16f2c7e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284718, "uuid": "733ec2ec-5414-4153-892d-dadf86389839", "value": "83F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284718, "uuid": "1dc0dcea-ea66-4958-8b1f-28255bc68dd2", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvB5YnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/HYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284718, "uuid": "431e3d38-d7c3-433d-82ff-bd6b1ba3bc01", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284718, "uuid": "97c93a00-feca-48e6-a9c4-cc449128cbde", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284718, "uuid": "a6a0e539-cbba-4170-91c7-1672fbbfb726", "value": "aea9076cc06c2dba15e21347b8eeafa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc551f13-d25a-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624257378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257378, "uuid": "164c5eb8-f082-4d94-9700-ed2549327c92", "comment": "Malware payload (AsyncRAT)", "value": "0d61dc75d6ac98519e3eb4db3bc57182", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257378, "uuid": "f10d07fe-9d5c-4eae-b0ca-65c69e2c8735", "comment": "Malware payload (AsyncRAT)", "value": "22d58928956b72b51835ec164268cc412c9a0538ea11038b82d302cb919e47c5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257378, "uuid": "734a1458-7a90-45e2-bf80-2acf3df65262", "comment": "Malware payload (AsyncRAT)", "value": "338e96473a313ef642d6336bb712bdc46b790e4d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257378, "uuid": "43f56af7-2783-48c2-b7c9-ab9f46e6fce0", "comment": "Malware payload (AsyncRAT)", "value": "8ffecc68b575951bf32219549803df2119f43d7858637e680e2cc2b43a23d38115f3d982a2a15b511a0961f48ceb338c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257378, "uuid": "9a69ed20-218e-4873-8db3-81eac198e161", "value": "86E0CD5D58059C041B0036DD4419C9269F5002586BB4802D7105C5993519EFD89509C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257378, "uuid": "c27714f0-6010-4308-98f9-dd0d2b228e60", "value": "6:KStTMQtxc3RGAJ7vAuVO+NosovfV3owgHmaefnqnpbNWS:KU1W3RGwrAuVdihfV4wgHma2qpbNWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257378, "uuid": "8af34b3d-ad30-4aca-9ab6-79099d81d98c", "value": 294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257378, "uuid": "e107a798-c355-488a-b104-274eaec570de", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257378, "uuid": "76f6632e-93e7-4991-a695-51891ba1616f", "value": "20-JuneStatement-2021ID10874956373110.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aaa3e7-d274-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624268210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624268210, "uuid": "8d21b593-a126-4803-a752-8b7952ef8510", "comment": "Malware payload (DCRat)", "value": "b711bb6226b7b0f15ebd9b016779fbc9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624268210, "uuid": "c052afca-670b-4af5-b424-685bad2974f7", "comment": "Malware payload (DCRat)", "value": "23373334a8179c86c6873e56c035ba848ea8023e2d717fc449b7f29ac2455657", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624268210, "uuid": "2180c696-a660-42de-a1c5-ec6ec784ec48", "comment": "Malware payload (DCRat)", "value": "84ea7dba528486c0377ea3a9af4e8cbcdd5927da", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624268210, "uuid": "b5cb7351-bed1-43fc-8d01-a041b0a04119", "comment": "Malware payload (DCRat)", "value": "99b54aff33a8673198f13edbd41355f39f279d55e0a4e91f97ab4813dd8cd4ef3dbe651a4cd68539ca24aebd3e431e55", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624268210, "uuid": "53f6b250-1448-4cf6-bf82-cf59960e2707", "value": "BF9533C5E0260D6AC0AE347D2BAF5D54208FB9879610DEE63C31E695C7464A1C3EFEC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624268210, "uuid": "c375332f-bfa8-4609-97a5-b53af16a85bf", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624268210, "uuid": "268b4624-4b3b-4d1d-b459-3ce114b4b08a", "value": "49152:CQWv2rUaDufC0fOWlqKFXQHeRljCKDQO9yDqoV5RNi0/bdyCdxz9lCeO:uv2r7KVOfKO+RljCKlYN5G0/bdyCdx3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624268210, "uuid": "f6b8899f-dc88-47d1-a3af-37b527a4c09f", "value": 2014208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624268210, "uuid": "0e65f69e-652f-4898-b96f-687e276bfc5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624268210, "uuid": "01adfd20-4e50-45f5-a2df-c40401745afc", "value": "B711BB6226B7B0F15EBD9B016779FBC9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc706ec-d22a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624236765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624236765, "uuid": "70f4b347-b7aa-49ec-b889-c43b4c7b3861", "comment": "Malware payload", "value": "a2491f60c2869f38faaff67e38f1cd52", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624236765, "uuid": "1c7c8862-2f2f-4482-80ad-2986d822f34c", "comment": "Malware payload", "value": "240b001a08e5659dff71de78549486c815e99c5d8b3fdfc32b45b46288aee33b", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624236765, "uuid": "f08157ea-36d1-4661-bdc6-b79d4afda8f6", "comment": "Malware payload", "value": "20ea09516d97114c711065643c8645c741139398", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624236765, "uuid": "9dec008b-a423-4047-9b86-308fb8a81977", "comment": "Malware payload", "value": "1c33f616290679b59cce086f306e1a35d836fea886a9120f9e47413dff81f999dc5e418725ac4310c27a994d1c8d9a4d", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624236765, "uuid": "eeb5d3b6-c716-4a42-b32e-1a529d1ced87", "value": "4744133F95B50117F47E34BA09035CA53E11D065418BB8EFAA74B78230B59A375B8E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624236765, "uuid": "30ba2717-57e7-495a-b600-3ae309ccb9a6", "value": "3072://zcY7qTwP6I2nA03b5x3KmTj4gBUsHM1AiOObeZUa6uMCLB2kNp3nRzg5uPalfb:X3AwSjn9KmTf1HsAfObAr6eBLn1AFFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624236765, "uuid": "2e19c747-ecc5-4249-afc0-1529b8fdb865", "value": 270852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624236765, "uuid": "f0cb4d14-2633-4cbd-891f-a8d1fbc3946d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624236765, "uuid": "75c8acae-1dd6-4213-a206-7d92cbd6b182", "value": "240b001a08e5659dff71de78549486c815e99c5d8b3fdfc32b45b46288aee33b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cdf570-d28c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624278575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278575, "uuid": "93ecd6e1-cc5f-4b0d-80a0-0c0adddac722", "comment": "Malware payload (AgentTesla)", "value": "061ec6caaab8f6902d40996ac9aa84bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278575, "uuid": "bc3f32ac-f5bc-41c1-8a4a-573ba20482de", "comment": "Malware payload (AgentTesla)", "value": "24dd3516bb7537fba691d2486dbbd2daf8729a2ba6fdfc90c7cd353418371390", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278575, "uuid": "a9fe3b19-8c37-4517-b5b1-aecf3b47fed6", "comment": "Malware payload (AgentTesla)", "value": "cfb3b483e56dd9c0c9c5c3b4ecb1695cc89a37be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278575, "uuid": "c4e35ea1-70fb-412b-9f79-b1817b4d0959", "comment": "Malware payload (AgentTesla)", "value": "64499f94c9bff45f52653ac87c91b79bac0ee3ba210fa936b175c2b6e48e5d75d37a63b0a35514f6ca6388a11a34ec09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278575, "uuid": "7dbe08b7-1eed-41ec-93c8-d875b8141983", "value": "7CF4C07039EE620DF5779F781AE436E19A7BBE537B07D95C24D4234A87238428F80939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278575, "uuid": "843d5f52-bbd6-4fea-ace2-dd0e69eedc93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278575, "uuid": "314f257b-b2bc-45c9-b5e2-a7fec5f6836a", "value": "12288:eqFfcWFHmseRcszlb+OSaorJao2rJaI8vhoajrHaxHhU:eK3H5C+rJaHrJaIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278575, "uuid": "85353922-f567-4d16-b59f-a08fa525c277", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278575, "uuid": "628889de-0161-4553-aee4-0e412d4c6300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278575, "uuid": "c1e4171d-b9ec-4536-bbac-aec9c467d0d8", "value": "invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5105b68-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624285256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285256, "uuid": "d0b09cad-8ca3-45b9-80df-2234f4637f36", "comment": "Malware payload (Gafgyt)", "value": "15047fe53c1c3d59030a7510efec8721", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285256, "uuid": "c331fcd6-514d-4d74-bd17-4759ea4d5ce7", "comment": "Malware payload (Gafgyt)", "value": "250f35841c8956333b6c285590c565d447d69f0158512a8ddc3ba5a04a27a736", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285256, "uuid": "7591b827-0e2c-4315-adb1-f04d6ae9ff3f", "comment": "Malware payload (Gafgyt)", "value": "124a280754b085867cce6dc0726fec173a4c391b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285256, "uuid": "b2ef0b02-fd29-4df1-8dc3-2294339d5c44", "comment": "Malware payload (Gafgyt)", "value": "ac29fad39540a68f1e209b539016cb692a008f16fe427d4dc7e3b67e95e368a6d60012a1625e753916c4501f062d4580", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285256, "uuid": "88492896-ed88-4af8-b41b-4f776197bf92", "value": "CC833A4399A19FB7C1866EB121B759300723FD115F1B2B99713CAAF4070B9CEB81EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285256, "uuid": "e515274c-fe57-472a-a517-c6f9efa1fbb0", "value": "1536:9O3iyzTadXWKU45/0RxLPBxJwHCXOIa4tpdJMLzSVyIYp2jtqm:8rzudXpUBRxLGHMOIatLzSVyIY2jtqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285256, "uuid": "9735fefd-433e-4387-aa3f-62a9576fcc52", "value": 85834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285256, "uuid": "ee704823-6c10-4089-a36b-0fdabdf6f9c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285256, "uuid": "a56354d5-29a0-4b99-8bbf-3186f1d41597", "value": "15047fe53c1c3d59030a7510efec8721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3e5b01-d2eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319576, "uuid": "f3c53910-427d-4fb4-98a3-781bd09e7f55", "comment": "Malware payload (Mirai)", "value": "0c2bbd6734a07ffa1aa86c0d0a700e66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319576, "uuid": "5fb15e28-e00e-47b3-b493-04bb336986c5", "comment": "Malware payload (Mirai)", "value": "25c1e5bca921969ab5f25935eddd092d2415e7bb84eb94ec302817917620ad7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319576, "uuid": "ca10c2c2-dc3d-4dea-83c6-5225e9534b7f", "comment": "Malware payload (Mirai)", "value": "85275e48c650b3108e4fbfbf14428376830dc2f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319576, "uuid": "1a53d887-b4db-4931-9444-b491cd6c5e10", "comment": "Malware payload (Mirai)", "value": "c799b0feb61fa15387aa59793fd28d5b0ece0cf75a48835fc5b7559ff7b974f8854be355b9dcfd8552eb366789ad7bf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319576, "uuid": "a26b640c-9b2d-45cb-abfa-9326927f4a40", "value": "98E2E02CA510085DF52ED8F7623407A01E989E7122821DACF4A5E7EB5F912E4AE875C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319576, "uuid": "fb5b967b-21d9-4f27-b747-b5bb8660fa91", "value": "768:K0YSyYdklmrEdQ5PFeMzKUZygW3PbJtlLAhRmxVEcJgGlzDpbuR1J9:tKmrEmPFeMzKzN3lYUVJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319576, "uuid": "1362bf6d-d23c-48f7-93d2-94fc6198e47f", "value": 32756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319576, "uuid": "8d91e5ba-22f0-4b62-9d93-115be14f4a80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319576, "uuid": "f4e3b91c-2a0a-4e48-98cd-44c50156300c", "value": "0c2bbd6734a07ffa1aa86c0d0a700e66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504fce04-d256-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624255372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255372, "uuid": "f0cea280-e216-4d91-a00e-58de4b1395cc", "comment": "Malware payload (NanoCore)", "value": "45eba04251118fb9d372500d1394afcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255372, "uuid": "4711e7f9-e60e-4145-9c21-937f52627747", "comment": "Malware payload (NanoCore)", "value": "25d8116f247bbc90103e46cb52fb180a1d58c7755a246be8030e47a86fe788b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255372, "uuid": "259c40ac-cdb8-40a2-bd63-0c68e29b5907", "comment": "Malware payload (NanoCore)", "value": "0fdb45274e1869469eba6ac1d15620ab78b22f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255372, "uuid": "c9db8374-e51a-41bd-9fa7-6b5d87601b5b", "comment": "Malware payload (NanoCore)", "value": "03390ed537f9427a01434561eb359b883f6dc5cf53d32cbbd61bcac293c69051385b55184107a642edbb01c761accd9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255372, "uuid": "0be461d0-032f-4568-8360-d77ea2d52627", "value": "11F47BAC3194B5AEC627CE76CAA82C60EA207577530BC207811706DE9A0DBD7DF146F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255372, "uuid": "3218d78d-77cb-4212-a1e1-0805d265e28d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255372, "uuid": "d1b69a67-1ae9-4aff-adbf-54e737b4741c", "value": "12288:sBywcsN98BhxZVjj8cr/lV9ks7yahCajs1h6EPuKKtnyE8tCbDtV7mOCvKOa/h3o:sBNcsc7HVjzrPWsXEPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255372, "uuid": "99454ad4-cd1a-4df1-b8a9-27c2d60d3322", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255372, "uuid": "c5eb9818-760e-4b2a-9411-7491aa1d2f42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255372, "uuid": "ccd43d1f-5cee-40ad-93e1-ea1a383922d5", "value": "P I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967abad4-d24d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624251624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251624, "uuid": "1174c0a9-8e80-4a64-962b-d1ad0aed706e", "comment": "Malware payload (AgentTesla)", "value": "d3c507ee6f263c07c1e8ee99b2da61e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251624, "uuid": "9280efee-2269-4998-8730-336dd1bb2551", "comment": "Malware payload (AgentTesla)", "value": "263629883576edf97a228911ad9ee109a377ff52f2ccb941ea0b1fc9c92a318b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251624, "uuid": "b6beb47e-d97e-4040-9054-870a8fe89334", "comment": "Malware payload (AgentTesla)", "value": "98e621121d2c954ec775c052803db44d6f335cf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251624, "uuid": "c49dc7b2-09f5-4168-9a86-4a5391b1f376", "comment": "Malware payload (AgentTesla)", "value": "b53b0b995bb7e00bd3409d2e1420d0e0e78fcaf653fd006379f9b0bb6974fa4ccf49e1a418fe88487c18c08391ee0b8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251624, "uuid": "9947cd68-a0af-4a27-ade8-3b0e567743c1", "value": "E3F4C03039EE911DF577AF741AE436E29A6FBE677B07D95C24E4234A87239028F40538", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251624, "uuid": "f6a0ae8e-7f94-44a9-98c6-67a240aefee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251624, "uuid": "b12a1b44-2278-485c-b87d-6109c410cf5a", "value": "12288:sS3hEi3WFHms9p9X8Qwey1VJ9aa9Eqbf7bNYBuJrHhU:sY/IHzpaQwe8V2qrNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624251624, "uuid": "e2b44053-9a24-4335-8ec4-516ed36d4298", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624251624, "uuid": "2b99cfa2-1701-482d-a52a-0e0f10e9e6a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251624, "uuid": "9aac10e9-19ea-4b02-853b-48deb12b9293", "value": "Swift Bildirimi 18062021,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f301f37b-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284421, "uuid": "e2d2daa7-2bf8-481d-92d3-ffc2b9fbeb64", "comment": "Malware payload (Gafgyt)", "value": "da135de85519170251ff257d772cbe53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284421, "uuid": "af77c3e5-3ada-4117-920b-bf3d1eaac5e5", "comment": "Malware payload (Gafgyt)", "value": "2648e5198ed7cbc64ca66366c6dd9a28e0d777a74804f803fd7a0d9e86e043d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284421, "uuid": "1496fc0d-e96f-4406-a659-0c83769ec749", "comment": "Malware payload (Gafgyt)", "value": "643cbb0737b69ad97cbf19c3c5260565123fa7a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284421, "uuid": "83a06b4e-cdc4-4d2d-9c44-36c41f1e848a", "comment": "Malware payload (Gafgyt)", "value": "1c831c2c0301086176f916adfd988d63a85a3d6aad599c7888790066d45e7e7b135c2ec8e579350eb4ae3065384b5d93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284421, "uuid": "40689bc2-7b26-4e81-8e9e-d1e4d26fa803", "value": "87B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284421, "uuid": "15a19966-ebe0-4bb5-9524-2b60a0b919e0", "value": "3072:MSY+46m1qOzsseFPPKNy+AmkZrQAhPDCXFke:06mgOzJeFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284421, "uuid": "f5ae7dc0-316a-4d87-8cd9-0a6262bde820", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284421, "uuid": "f376d55a-10db-4783-9064-cb52de254d40", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284421, "uuid": "012e2e8d-5edd-4832-a55c-994d5fc9a330", "value": "da135de85519170251ff257d772cbe53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8a88a3-d2c3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624302368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302368, "uuid": "de2b8d6b-a376-40fa-a66e-5e7519bfe305", "comment": "Malware payload", "value": "d41fd52d9df1ecbe0c50fa97fc206763", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302368, "uuid": "d1bec1ea-a9e7-4d87-a236-156590354c4e", "comment": "Malware payload", "value": "26c3b09d7132ab5d216de7ba7351d14cd1cceaa714a3642c6d3c5cc5775ce5ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302368, "uuid": "a20705cb-973c-43f1-98c6-e82fe89f9307", "comment": "Malware payload", "value": "9c1052555a9708626815254536d3fe5542b966d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302368, "uuid": "4a9a6995-06a1-4a84-9018-759af7635820", "comment": "Malware payload", "value": "cfa667f85cd99fb80022c733145474e3fe6aee55558c41991d95c6e4ab9a2002bca0348d867f9181a9ac8d27b5777b2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302368, "uuid": "fce392a5-9d53-4a2f-9f01-50e65307dbca", "value": "F2530264F0463D349EB1C8B5BA66D2C737566B3EEB60EC4096AA434829CCB8F45D3491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302368, "uuid": "7b944ca1-efa3-41c8-97c0-ba57beb02f66", "value": "1536:VkuuC5IYZ9KtQC8W16bWTNuiwNrtqp9LTLzzazB7c8znNxOynPqEB8a:df3GDgbWZmNr4rXLKVc8zN9nymB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302368, "uuid": "113435a8-02bf-4ed0-b690-d2780ff6a0d8", "value": 63860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302368, "uuid": "2030b855-d952-40b3-a2dd-1f784a97c975", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302368, "uuid": "7f4dce95-6d91-4a5c-808e-1c01575365e2", "value": "d41fd52d9df1ecbe0c50fa97fc206763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff539ce-d2eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319581, "uuid": "39c63ee0-7af6-4638-a186-6d3132837a04", "comment": "Malware payload (Mirai)", "value": "361be63384b892c671f6d37cfe3fb9d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319581, "uuid": "3b6ca4af-3327-4ec7-8478-7a5776075011", "comment": "Malware payload (Mirai)", "value": "270d4a94691996cd9f6689b09aede8cf6bd8ac6c4b3d93b0d23944f42f986568", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319581, "uuid": "b527f90b-9fb1-43ab-8633-1efcbc9027fb", "comment": "Malware payload (Mirai)", "value": "a1f74be99bb945d4cc22f56eab0b8d45a443ca81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319581, "uuid": "02be8c5b-fcb7-43b1-82bb-2c33e4c105e2", "comment": "Malware payload (Mirai)", "value": "4a6e391145a16f59876585ea99ce848c567fb024b6378895b74b33a4cd6862d73db601f45cf10ef799723fca4783a8ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319581, "uuid": "d1ad946b-06ce-4c43-a0f3-f35c2f7cbca4", "value": "647319DAA0014E6CFC9BE9FD92214F09F920221145830B16B3A7FED77F721A99D53D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319581, "uuid": "64b7f5d8-8bfa-4e63-8761-22f46b5bcd6d", "value": "1536:kPK+ugXKa3nn4p64uBRPTfzm7ok8g1pY4OrjcHov68jJdMXrv8S:kPn4LuBNkxpYRaktM7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319581, "uuid": "7d7d2426-d651-4c1f-b3bf-6852dda912f9", "value": 76700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319581, "uuid": "d4b97661-8414-4fe2-8f00-f4219e3c516e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319581, "uuid": "2a1bfd9d-4c57-44a2-9ab7-728535f1b623", "value": "361be63384b892c671f6d37cfe3fb9d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f72d6b-d256-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624255269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255269, "uuid": "078133cb-fe87-4d48-b5ba-ffb3f42d0e96", "comment": "Malware payload", "value": "d069aa2e93b8dcdc014bdfc6d98c2120", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255269, "uuid": "954e04a8-7ac9-42a2-8372-ea713de07627", "comment": "Malware payload", "value": "271a00ded76e96717301d8023b7e75e80adc4e70c9f09bc18f087dddc2f39200", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255269, "uuid": "7d9cd46c-b9a5-4c62-89af-7cfbdf2f57a0", "comment": "Malware payload", "value": "289a0022a87a518f3db0063284adcc535f4a749f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255269, "uuid": "c3597139-9473-42d5-bdaa-66facb546b03", "comment": "Malware payload", "value": "dc048c095d1009e26463e93dfb9030bfe4b74888f5777b78d590d30593a28f4517aec79c5b93b5e54d3fedbc67a8738a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255269, "uuid": "b93549ca-2696-4313-8c44-999e03dd22a0", "value": "A9D2F141D55EC8F8D251A4BB5A3D38CD1CB2761C1B599AB3BB4C0356E242F4839CE22B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255269, "uuid": "246609cd-a04f-49cf-8edf-54b725d383f9", "value": "768:Y183l7JpsICL7+GRtaCzZSk97ienbcuyD7UryqR:L3dzsHPUGdienouy8mqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255269, "uuid": "88b7d412-e417-4385-b610-6eedf4716830", "value": 29140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255269, "uuid": "77d54124-3285-4a8f-93d0-b8a53ea586e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255269, "uuid": "69c857dd-8049-4085-ab74-0f4d66c8fca9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fa144b-d264-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624261319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261319, "uuid": "f0ed48d9-7a8f-490b-bf11-b8023ae47d8c", "comment": "Malware payload (RedLineStealer)", "value": "a95bb1343c29105865169e1d71f6c680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261319, "uuid": "5afecb65-7c98-49d3-9ce6-427e5b6c54a4", "comment": "Malware payload (RedLineStealer)", "value": "2721ff646e43f708f7cec63b22b39b4b275dd9a8eb77430ad03ef4c651d99af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261319, "uuid": "f0282d0f-18d3-4577-97cb-17b83b31b3d0", "comment": "Malware payload (RedLineStealer)", "value": "fd196eee1f53dec81e828bd6f18e7072c287b74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261319, "uuid": "96747b64-3aaf-487f-af6d-a77b91b049d9", "comment": "Malware payload (RedLineStealer)", "value": "5a99bd4d15f8b10d8eebca8e5615fe0de716efb699fa13fe9ab90cc47db7dfc88feecf5e493554219a19ddec83887f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261319, "uuid": "61a15583-873e-4d90-83d1-9a4dc3e3abf4", "value": "C265744073434E48EC980936A2219C34CFED6F2D75FDEDA469A6B96C4953708A93F1F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261319, "uuid": "01988619-5a4a-4871-843f-7ad2a268c65f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261319, "uuid": "6af3e284-d37e-4019-bb32-cdef888acd74", "value": "12288:RjtziXeeee9Uri1N/3jvd1T12+FMy2R97N0UVlIo:zziGrij/zrTc+U953T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624261319, "uuid": "a55252e9-0403-453c-8dca-d4946487dab8", "value": 1506158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624261319, "uuid": "99c97517-9746-40c2-b579-15f3e1c3e16b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261319, "uuid": "cd1126c9-6b17-4003-ae2c-9ef32a5bc996", "value": "a95bb1343c29105865169e1d71f6c680.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec89b147-d2b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1624296006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624296006, "uuid": "98f90b6c-c177-454c-a0c4-21ca29f89b97", "comment": "Malware payload (Dridex)", "value": "19d2f30acc9667509bf140e8a49532f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624296006, "uuid": "fa612aa5-1cfb-4cf3-a717-f3b937ac05cb", "comment": "Malware payload (Dridex)", "value": "27b6c3c4715196458a2a348b8267fdb92ef46e19064e0c30d5aaa97a82b3ca63", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624296006, "uuid": "ca2bf508-1d76-4a95-b283-1edc0305d8f8", "comment": "Malware payload (Dridex)", "value": "4599559a3308a928745dbdb0b4c228d7e13746cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624296006, "uuid": "efee3cbf-0b56-44ff-b858-a28868bd5a87", "comment": "Malware payload (Dridex)", "value": "44d4b45729b9b084d95ffb6cad03d8a8cfc9ac4eee111443ca8daf5a257cea3fb5affbc1b49cb83adbf733a11b4a0ec4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624296006, "uuid": "ed652ad7-fe89-4fb4-92d9-e12b074e030d", "value": "E004D01FEAD706CDE337AA333A5D732B62C45612DF19D0A8CE14D2FBC1B14904682A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624296006, "uuid": "7ca2937e-c870-44b7-8bb4-d309a6d8f91f", "value": "b380277cbb8ae5571489cb34552d83fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624296006, "uuid": "49ae8ca5-9a82-42c8-aea3-ff6e8323a101", "value": "3072:NuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:RzWxkOP4p2EesvcDi6DOHPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624296006, "uuid": "d90f7be6-1038-43fb-a3b1-40cd128081b2", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624296006, "uuid": "5ac23600-3f28-48ce-b23e-e72bfebc1777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624296006, "uuid": "6387848a-a30f-47a1-8afb-100e7c019a46", "value": "2cAwMgDOoJ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447926d8-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624298731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298731, "uuid": "b1c1be6c-5133-4903-b1cd-0aee130e0c44", "comment": "Malware payload (AgentTesla)", "value": "81c3f4268585c2aee9883d71ea160da8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298731, "uuid": "a4b44c17-e591-42fe-814c-5821eebaf811", "comment": "Malware payload (AgentTesla)", "value": "27cbe0ee3ed2d3994d62ef21b9b2ebd3f929c5370336b16e96aef3a87b00fab6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298731, "uuid": "01cc8a95-f07f-4962-8cef-b9552d46ddff", "comment": "Malware payload (AgentTesla)", "value": "797ae53d04b432fe33a0d2e557d3e8c91d787f44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298731, "uuid": "63560a4f-d6eb-4072-9c3b-fe1bc47f4d6e", "comment": "Malware payload (AgentTesla)", "value": "bc285845cc848b0b917717c38bbca4512082492edcea4563d0fc2984d1107400708a25bf0e849df9d3a0a0192041b434", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298731, "uuid": "69e7bbda-11ff-4716-8738-70fbdc057a7b", "value": "53F4BF3039EE620DF577AE741AE476E2967F7E637B07DC5C24D5224A8B23902CB40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298731, "uuid": "c8a7a407-4d0c-4307-95e8-88ede1af418a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298731, "uuid": "48eaefc5-b3a8-4d3a-bdeb-304f75e95b0d", "value": "12288:Dd+zHcWFHmseHgPpjfAYvzwlK3iDT7wQkD+93wD0eGesSxgnCJHhU:DC3HRPpjn45jNkaPSx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298731, "uuid": "0d71e4f8-2426-405e-a5cd-3002cc7d9e2d", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298731, "uuid": "a6a4b37b-c239-468b-b249-e3588c85225b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298731, "uuid": "05cabbcd-b7d1-4c69-b054-8dcb1e0b5526", "value": "81c3f4268585c2aee9883d71ea160da8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e754b599-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624285260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285260, "uuid": "a9576004-4288-4ac7-9382-004cfd55177b", "comment": "Malware payload (Gafgyt)", "value": "58417a423e88099512ed4174365f9dca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285260, "uuid": "b1f6e2e7-f323-418d-bd98-bf7d1747ea3a", "comment": "Malware payload (Gafgyt)", "value": "288fb6769e9191732b8bbf412c8edd54788d6440088cd5b263a1714c273a7687", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285260, "uuid": "7042c069-d945-4b9b-b395-5c8ff43335c6", "comment": "Malware payload (Gafgyt)", "value": "418568f83359779fab27e315b089e101cf485e6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285260, "uuid": "78c8686b-7044-4c6e-beea-54b776d11cbd", "comment": "Malware payload (Gafgyt)", "value": "1026e0cae0fe16c4d0ecd8be221f4d7806c81da95c93e26dfff8c9354389f810d15bf9bd5d66fe20b76c196f74838029", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285260, "uuid": "c6b70766-7491-4b7b-80eb-94d255a3f789", "value": "1BC39417BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285260, "uuid": "79a76795-323d-456f-afd0-29a897840b5c", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epz+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Ep+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285260, "uuid": "5e0f1614-2e2c-4fb6-a356-ee71010cbc78", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285260, "uuid": "5a7b3a48-2dfb-4c54-9cdf-36d431af4b94", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285260, "uuid": "d4fe6689-cb5e-455d-b7b7-d6787afcc9c1", "value": "58417a423e88099512ed4174365f9dca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9300955f-d295-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624282542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282542, "uuid": "9462d1c4-d791-47e2-81c3-ebd1739d491f", "comment": "Malware payload", "value": "21f0796150871cdda35055e8d8959e7c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282542, "uuid": "948ace63-17d3-4936-af2a-2f7966ac303d", "comment": "Malware payload", "value": "290792c51359023738c28693603d5d38cc7a343541e3932f587b6d184e4790ef", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282542, "uuid": "6a152b19-0d0a-435b-8249-d22fb79677d9", "comment": "Malware payload", "value": "7496741cf1d8abdf7a172ecd358e09fd1bff8b40", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282542, "uuid": "a4257477-9764-4ded-a087-f82bd27ac180", "comment": "Malware payload", "value": "d67a2fac37e77f248700097cf2f1c65b296be57464a7f587ee0b130ea8698a3351d1806086f28521c1a9a37cca6498da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282542, "uuid": "210b0a69-e045-43b0-bcf8-931edbeb2155", "value": "DF15AEF876147DE6266F576BDA96ACDD03B52A239ACBA4CC806477C305A3375FE02C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282542, "uuid": "f6e4e9c5-b38c-4dd1-a290-573694c11eb6", "value": "24576:wK+qTe9lgSGhZi+dD0jBRYQ7hrB+nOyt2kaAiGs2Hs:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624282542, "uuid": "014f711e-dcaf-4b76-b009-b8665f667b5b", "value": 943260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624282542, "uuid": "de0ff601-aa05-48d6-b76d-7a91638b06f6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282542, "uuid": "418de380-e547-4ac6-952a-e2a3851e4e61", "value": "inv544-payment-copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f3084a-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258874, "uuid": "add41068-799c-4bf9-8eba-64a92a4430d0", "comment": "Malware payload (RedLineStealer)", "value": "f4e708006baee1657124ae3fae856b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258874, "uuid": "920bc788-3cf5-4d86-bd7e-75db447e8603", "comment": "Malware payload (RedLineStealer)", "value": "295aefa2685ec9f29ce8e99472f022c8ed4ffbad92550d569bcbcefbbfa48eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258874, "uuid": "d3666b0c-3c44-4fd9-8618-4974b9d1bf93", "comment": "Malware payload (RedLineStealer)", "value": "191074e50c9f6435d61788df91fb5c0d8f5783d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258874, "uuid": "dd68dfbc-7462-483f-ae49-d1b6c5da3dff", "comment": "Malware payload (RedLineStealer)", "value": "27da56b9ab7eb1638881e82f2cffc489245a554815d0a4311a36c942cc82ae8c6366ad60481c7acc313aeeb8c5c0777b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258874, "uuid": "d53bf626-c1ab-4c5f-ae5e-4a7269d27f3a", "value": "3C84AF10F6A1C035F2F762F45ABA93A8A93E7AA1573450CF12D52ADE5A347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258874, "uuid": "6ad697f7-9e8e-4260-a083-86b0adb07f19", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258874, "uuid": "5970bb92-ff1f-4adc-9e42-5a3cf645bdad", "value": "6144:egP2ZI0oIiJXy4tEOGhK8bNDcQ7s+pXEI5jXBCGlFHOo1yVPVKriC:T2Z1oIiJi4tUK8bdHowEI5jxCIF9Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258874, "uuid": "6d1265de-c71b-49cb-997e-9d41baadb610", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258874, "uuid": "41492894-f2ed-4db4-beed-18ce3a14f6cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258874, "uuid": "af816cc9-a41e-4948-b6b2-af321fae545c", "value": "f4e708006baee1657124ae3fae856b1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9122ad-d2cf-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624307496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307496, "uuid": "5ee1a41d-a0c0-4354-8372-cd5259338d34", "comment": "Malware payload (RedLineStealer)", "value": "37ea12a8b28a3ee9f005e35d3b1adf57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307496, "uuid": "8997c914-94c0-4ad3-a56d-7ab1326262b7", "comment": "Malware payload (RedLineStealer)", "value": "2a3650fe227cd9e83c05b6e009ce3e4a1504244ed5871cc3fe6a2183e085386a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307496, "uuid": "e8f7ec88-4ff7-4d10-a268-3f3a549d0d35", "comment": "Malware payload (RedLineStealer)", "value": "23da3e203279e4c559febc41b302619be4e40c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307496, "uuid": "e8cd4da3-7808-4da9-9234-daaa399275f3", "comment": "Malware payload (RedLineStealer)", "value": "f982041f6e1b860e95ddead2e633f84e79c1a816fd49a75ba55b2e2a859587dd51e4b7d6cbe2874e6b98406f7422c55e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307496, "uuid": "a1520568-8a6a-443b-9a01-3e4a85217111", "value": "642501CD37A1B7B9D15E78F04B75A7A305225EAD0F93C9832788FB06FF2C1848269255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307496, "uuid": "398402ee-eea8-46c3-aa5a-df4ffdc0e608", "value": "650ed02ca4b6baad6b24f20402b6268b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307496, "uuid": "e5abeb03-10d6-4703-9caf-cf43ad55708e", "value": "24576:r5REvpedfR/V2v5007snDhjPdOjUA+bYHtBdkV08grM7lKL:rARed5cR00ANJ1mx60u7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624307496, "uuid": "ed823753-1f6b-48db-8628-c0661bd49f9f", "value": 1049671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624307496, "uuid": "2bb0da4b-6322-4831-8c5e-fd5ff801f1c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307496, "uuid": "a2019054-549a-4966-84f4-a78d0e8dbb59", "value": "37EA12A8B28A3EE9F005E35D3B1ADF57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e596d67d-d24c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624251327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251327, "uuid": "547c53e3-3b94-4b0c-a527-2e488f619cd4", "comment": "Malware payload (Formbook)", "value": "0f8baba0fe80ce5a3e07a8b9cec3f2b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251327, "uuid": "8f87dffb-28b9-44c7-8166-1a2e34819b0e", "comment": "Malware payload (Formbook)", "value": "2af0658896a383b330189fc121c48dc390a90a1f1a61033326e01cb9e80465e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251327, "uuid": "63a1996e-897f-42b4-b0e4-f875e1f7607f", "comment": "Malware payload (Formbook)", "value": "434f2f712f46b9737ad3b85cb7da14c6f2ce8478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251327, "uuid": "44e5346f-04a4-4bcf-906f-1e6d9190655e", "comment": "Malware payload (Formbook)", "value": "aa77ff9ee60dbd9268ac6b9019e0cb3011aef3f171dd4c594da77fa48a95ade639a77dbaa02da8f9c057b0be3183dde8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251327, "uuid": "1e9b65e8-2d56-4c44-badd-2a6ef24af2d5", "value": "0DF4BF6039EE910DE577AF781AE436E29A7B7E537B07DC5C24D4224A8B23D42CF40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251327, "uuid": "0161cfe0-6096-41a1-96b4-8b3749a74935", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251327, "uuid": "806d047e-acfe-41c9-b52b-52a24fe3f505", "value": "12288:Qr38G9WFHmsZTdY11FQhtgDrlxir963ENPDNrIerNmGEICFYSTHhU:QTdKHfu13QPSr+957IkNmbrYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624251327, "uuid": "0c479c3b-b156-4da5-b40f-ce79d6fecc84", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624251327, "uuid": "49e1de73-9558-46e7-b746-f98763ea1127", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251327, "uuid": "c23c7617-9140-4df0-83a7-87f891774349", "value": "New Order_PO 1164_HD-F 4020 6K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ba6bab-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624298981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298981, "uuid": "fb552156-ba41-4558-916b-6378c55f6538", "comment": "Malware payload (Mirai)", "value": "007c04462423ef5f0d8e400b0c5ab1f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298981, "uuid": "15e4a0ad-340a-4a9b-9040-2b3e946de811", "comment": "Malware payload (Mirai)", "value": "2b29f96fca889745a577f961498e1badba26a2e0c91a0b1c85cea65e7080b982", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298981, "uuid": "73f07e9e-6df1-4cb7-8a6b-4ef84004702f", "comment": "Malware payload (Mirai)", "value": "1c80cec539f09f111471524a4efedf9109b68257", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298981, "uuid": "d3b9a710-5e88-4292-b450-78c2fe2bec70", "comment": "Malware payload (Mirai)", "value": "16ac4990368d741c033e9c0ffe178de0e2341b523f55cc766148b75dbf824360a381c5009b7c5f50697706212ac49f1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298981, "uuid": "ac2e7463-129e-43a7-a7e3-8243f596cbc4", "value": "64B2D0717011F8B2C7E200B769EDCA83FB811EF8D0E873395464099DEAD5D42AAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298981, "uuid": "5b49cc1c-aceb-4768-a729-a8aa51bb73eb", "value": "384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p2hymdGUop5hs:5X9nxn8o9wnBoWzEQf2EjKb3p2s3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298981, "uuid": "1f968758-4242-48e4-992e-8a47716c5abf", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298981, "uuid": "2adfe48d-f00e-412e-8c2a-039c98e9afdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298981, "uuid": "e642d21e-f13e-48c2-b0f3-5181692033f5", "value": "007c04462423ef5f0d8e400b0c5ab1f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35bca24-d296-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624282999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282999, "uuid": "31964141-5183-481b-9c7e-19fd48f4e78d", "comment": "Malware payload (Gafgyt)", "value": "b68018eca70f1eff6fb4c5fef6eb98a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282999, "uuid": "249718d8-85c5-4158-9a98-0ba3baf140fe", "comment": "Malware payload (Gafgyt)", "value": "2c123b50067d4cd49a46dfe25792ebe94fa4e3369b7c18c16671fe956969e94e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282999, "uuid": "c50ae82f-8eb6-4ea9-b6a8-ce83fdcc2a00", "comment": "Malware payload (Gafgyt)", "value": "93ecb25a2e8ae16007b488f52f44eae43bf4ddac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282999, "uuid": "a4c7f4cd-c68d-45f0-8271-7e1061247714", "comment": "Malware payload (Gafgyt)", "value": "fef2390af4f229f1196d2beeedee8561fd4d41cf496efc765dde6bb58abfb175f1a911f90bdb1221cbf40416bed1ac63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282999, "uuid": "a60b1908-4344-413b-b103-fc06e6c59000", "value": "43E2E10258ECCF28D57920BA6E6B775A0862F20D73826F719F98AB775610F252F4C713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282999, "uuid": "b50fec29-1c18-4e6c-b5cc-bd52d65e7be6", "value": "768:wrKBirq/kT8aMCNNUsMOZ39QFawt/7xH3vIRuLNnbcuyD7UryqJ:wr+i+MoKN6NOZ32Fjlftnouy8mqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624282999, "uuid": "538f264d-a715-4737-a384-d7ab97569321", "value": 34100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624282999, "uuid": "1409391f-828a-4753-9c62-89097839bea3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282999, "uuid": "f0678c80-1690-4655-a451-d23cd2fd68d3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6422b790-d261-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624260129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624260129, "uuid": "c9f817f8-e3d4-4327-9b6a-2649c83a16bc", "comment": "Malware payload (Loki)", "value": "5cf3d618c735999f238aef63047e3f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624260129, "uuid": "e2b0150d-ff77-431c-96c1-bdded96f51b1", "comment": "Malware payload (Loki)", "value": "2d0e2e19f2d3e2faf0ca86ed07ecba6c8b6573ba00247b78fbb73e72c0a56311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624260129, "uuid": "d72b11de-377f-4e28-9819-bc61992882dd", "comment": "Malware payload (Loki)", "value": "777f99af07db4560592e2a2eff05c816a3f762e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624260129, "uuid": "808499b7-1101-45fb-9aa9-58619ebe8cb6", "comment": "Malware payload (Loki)", "value": "755e8bc52b2f29259cb4db6fe35a9cc7edd797704113c248ee9c2087942c2e2272ca82d76b4c2a958a613635bcf58f09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624260129, "uuid": "d1b2a465-165b-4e02-913a-aa1501f1f1fc", "value": "37D4AF3039EEA20DF577AE781AE436E2967B7E537B07D95C24D4234A8723902CF41939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624260129, "uuid": "f24984d7-eaff-42cb-b12d-1b28a1981647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624260129, "uuid": "886c51f5-1623-4d0d-a28a-7350e12604c0", "value": "12288:7PPd6WFHmsaexDAG6z/G3bCmRDQ1jPPXwrueQMWnf4y2iHhU:7NhHDlAGL617PX+Q3fG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624260129, "uuid": "b1d5503e-69e8-47cc-ad35-a40dae6276fb", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624260129, "uuid": "71c88fa3-79b6-4cfe-8782-2b081c18e7fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624260129, "uuid": "68b0ab10-4ea6-40e9-aedb-b098ee238505", "value": "MqaRnuUlL4etOtz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9755143f-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624303594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303594, "uuid": "d1bc3e1d-b056-4e08-ac2a-9f4e3ffa5fd7", "comment": "Malware payload (Gozi)", "value": "49af33aa7ecc1a785c1fe96c1946aad1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303594, "uuid": "c9c944ce-87cb-4466-ad00-bf8e49711580", "comment": "Malware payload (Gozi)", "value": "2da9852912cf01db29e1b3db4a1b9599979ac3c63a6522f5a4a771938c2b36db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303594, "uuid": "03c2f38d-43db-4e80-b760-ab9343b54ecb", "comment": "Malware payload (Gozi)", "value": "8c2d963af567367151400c4558e21e5711d1707d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303594, "uuid": "c8729907-0ef5-42e2-b040-5ad4658813d3", "comment": "Malware payload (Gozi)", "value": "78950acdb066b55c1076bce1fd38ea3bb9e94d0e1a786fa58bce81f0a6313ef996193688293b39b5626371bf8adbdce6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303594, "uuid": "c9011422-1c4f-4028-b362-3b87a74b5e86", "value": "F3647C0179889030D6B262764F24EB810BBDB9651B71CECF37DC1A8E1F394E29376762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303594, "uuid": "8973000c-4905-44b2-9b55-f1cd8f640f88", "value": "cafd4f67066e4431e00f052908a506e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303594, "uuid": "03e8c5ea-1950-4c1b-9ab1-7f6851c5084b", "value": "6144:oUtzB0RzsWEV3SwEwlR81T/F19W6fepyq85t:oUZKRzsthSwtRq/5W6fepyb5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303594, "uuid": "feeee914-0118-4ebb-bac2-9772c5bcb4df", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303594, "uuid": "42b06260-4fcb-4966-b25c-0d677bab7a6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303594, "uuid": "d90bb834-2beb-4c97-8aed-c3e19b52e658", "value": "bytesRCount.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6402dc-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284438, "uuid": "00eec03a-0800-464e-b7a1-963c7bf0d665", "comment": "Malware payload (Gafgyt)", "value": "32019da4fd59732594face2c7481f852", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284438, "uuid": "c2f4ea8b-74ec-44ce-99b5-cf34cbba90fa", "comment": "Malware payload (Gafgyt)", "value": "2e267392b89922537c23e877eabb30af265645e304e51839497bbda4d64d952d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284438, "uuid": "2b216c85-cbdb-47a6-b2cf-2c8f898fe43b", "comment": "Malware payload (Gafgyt)", "value": "3e8ee0af6e4a4eade93481b5d5acce4523e563d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284438, "uuid": "f5f7c612-8ae2-4d86-8cbd-b5ff054f8f13", "comment": "Malware payload (Gafgyt)", "value": "3f51cc4411e75f725a8629e523cb612bc05152ea50c67736adbbd9b76a59a5af78094cf23b5cf93c08d87cc62815fecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284438, "uuid": "846e58c0-bf01-427d-8dec-8e0139675d62", "value": "7E933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284438, "uuid": "4e58bf3b-5f79-4d6c-8cac-d2b1d9ec78f1", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+85l4umXxVqDrstKfz9e:Q97vk51RcG7Afl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284438, "uuid": "146e0980-24da-498d-add7-577b5f348f6f", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284438, "uuid": "edf080ed-5e3f-402e-ab1b-cc23914bcef2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284438, "uuid": "a416d9e0-47ca-4814-9b12-7b24e882e47b", "value": "32019da4fd59732594face2c7481f852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76455804-d2c4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624302680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302680, "uuid": "5f295668-96c5-4c37-ae2f-c31342a8297e", "comment": "Malware payload", "value": "b52fd4ef268b7daf3def8968e1ee0536", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302680, "uuid": "53ef02ef-8d80-45a2-a764-a27dbf5200ea", "comment": "Malware payload", "value": "2e9ff911bedd419368c19dd6a0e3687c2afd88e744978ac432c244eaaa752a85", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302680, "uuid": "f1b42538-053d-44bb-8461-73bcaa2e1dfb", "comment": "Malware payload", "value": "488ab19058dc9be81fefa69f057783bc0fe4b15b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302680, "uuid": "63a671c4-dac2-455b-80d2-4a2208a7c5fa", "comment": "Malware payload", "value": "a10e805996751398ccd6c4cd0a04705581486a10f2f3708523c5a15f296d765a8aa34f1fda635e2f92535ecfb894f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302680, "uuid": "c889b223-c48c-4342-b902-e0a0113f10ec", "value": "5E53F2EBA1767367C0B284B045378084BEB02E9E7F5B4F979085F9ED0D45DD93A12E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302680, "uuid": "83f7f976-8759-4036-a5aa-db88d77215c3", "value": "768:cGVyzPiBfv10vOfwKvl/7bu+oC63gPjXnLsUCwXM4JhwHH/x0kVRxLzOWK7X6gWi:h8sWvcvl/Iw7CYe/v9POBx6y6nyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302680, "uuid": "4e172318-436f-47fa-bb2e-d1cda6582958", "value": 63852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302680, "uuid": "468e6331-fe15-4685-97eb-f31cc3389ba4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302680, "uuid": "47a19019-26aa-4faa-af44-3accd1a47180", "value": "b52fd4ef268b7daf3def8968e1ee0536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3faed4-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303177, "uuid": "37244c63-7d8f-4b1c-b6a4-dd5b3ed105a9", "comment": "Malware payload", "value": "84422deccd26cc19b39cc6ecc97cd8c6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303177, "uuid": "3f1d83f9-1f36-450b-8ecc-85d70326dc6c", "comment": "Malware payload", "value": "2f119823e4005e0126d947cf59ca877bd4c5e0ed63a1c2170198f6198ff07608", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303177, "uuid": "beace9bd-663b-4538-9717-5b955c882873", "comment": "Malware payload", "value": "d9c1e952be96249aebc5b6ff0c449d33a46fe31d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303177, "uuid": "b32634e1-c1b1-4198-a3f5-88ea95c5518d", "comment": "Malware payload", "value": "4aca34633c9914d2525cbedb92f100fad454d23990fd2b166bb18805be064380092597880cc0a48d9909f80132b09c69", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303177, "uuid": "beb31c1e-05df-4c86-a958-ed52ed4e838c", "value": "6133C014F101DCA1DB2FBD7892B950B066AB17B4F3805CD97884D68D4DF116E8B2B7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303177, "uuid": "e969073a-604c-4607-acab-692c415e2706", "value": "1536:/s0bKQIOf7SieU6ZDvxjxcpAr/USvhWNssHT:/VKWSiebvxju4/UchWNssHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303177, "uuid": "0da15719-147d-4d65-8b2f-009ec7434a43", "value": 51417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303177, "uuid": "44a6531e-e949-4920-9dbd-8010dbe9bf66", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303177, "uuid": "cbe7acd4-1969-4e76-83d5-61c4b37db12e", "value": "instrument indenture,06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de1baa1-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624287204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287204, "uuid": "ed77af01-097a-4ba1-8622-dcb4d63e6d9a", "comment": "Malware payload (Formbook)", "value": "2c9da6dd8bc3124429c9e0da2bc38c63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287204, "uuid": "f1fac14f-560c-43b1-8a76-d9df3361da14", "comment": "Malware payload (Formbook)", "value": "3026185f9dd7b26700a92b8d5d2eb94b8f7f246b944fcb49c8e8bdc41c2c6094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287204, "uuid": "6b5420d9-e8b5-416c-a825-9dfa0783563f", "comment": "Malware payload (Formbook)", "value": "1413ec35828203a5093f89671e82571a7cb798f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287204, "uuid": "d3ac9ed6-0852-46e6-b426-78b20cc1a066", "comment": "Malware payload (Formbook)", "value": "f76ef6041f9e7fc305ff6329bc91258bb2a81169123ab176f706e038aefefd53fdfe2c6277c28b917ae75c82abfcf78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287204, "uuid": "64acfa31-7cd4-4ee0-a759-ae16ca78aa70", "value": "AA1412132AD1C4B7F1B2037016B6FE7FEA7599846176C5CF43606F3A3E112CA8A1A653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287204, "uuid": "b88d2914-c5ea-48ca-8345-c82a49845ffe", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287204, "uuid": "69104eea-cd45-46bf-8726-9b613674dfa5", "value": "3072:wBynOpL12rioc8MuFDLFbencopdGwWnqpcB65F+qQQB/npRTR6DRJvHmpp9WnZZX:wBlL/9ItecADWquBA+54pBR6N18p9qZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287204, "uuid": "d972e529-0b8b-4ffe-9240-5d65f88e8d8d", "value": 205695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287204, "uuid": "57288098-5092-4822-bcf8-9ae362e4870c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287204, "uuid": "7e96fb5c-f140-41d1-9202-1c62c7698230", "value": "2c9da6dd8bc3124429c9e0da2bc38c63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d717e17d-d2ae-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624293393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624293393, "uuid": "5251b59d-9158-4225-a068-806d6ae57040", "comment": "Malware payload (RemcosRAT)", "value": "41e52f95b20af2d8d27ec87d69e6c593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624293393, "uuid": "6f3e9fde-9ef2-479f-bd4d-a12f8d8b395c", "comment": "Malware payload (RemcosRAT)", "value": "3070ba52a9be47b5dfa4088095f0f35827a3cc12590cf3a30082e2021b2cf956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624293393, "uuid": "1bfcea86-8446-4241-b2df-b346f5a1d116", "comment": "Malware payload (RemcosRAT)", "value": "09b6fa4f68d814c9af1f859de84b265fed2034cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624293393, "uuid": "588b3ab1-5fb1-4204-83af-a8273d5d11c6", "comment": "Malware payload (RemcosRAT)", "value": "045f2826b5a53f7803fd01cc502daf3b60744521be96e6b08dc1bbc5b00402dc9ac724183b4f8237c1055b654b2e6724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624293393, "uuid": "5b96c422-a36f-4372-9776-66771548b60a", "value": "A415AE2436E96B18F0BB9B7B89E42581D7FEFD13A712C45D2CD522CE4662F80DA50336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624293393, "uuid": "462f16fe-918d-4743-930f-9c57e8b29c17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624293393, "uuid": "3740b6b2-671e-4eed-a3c7-6ae03dd0f170", "value": "24576:5vu2X2X2X2n2X2X2zBebayL35eqAfwwWF:Lmmm2mmzBsL3MXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624293393, "uuid": "13e0c160-04fe-4d46-a461-0b6830b4037e", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624293393, "uuid": "c0a2a5f5-dfd4-4df0-b48c-996722f1ad07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624293393, "uuid": "674ea648-d02d-42fa-8e5f-8f5d4632135f", "value": "3070ba52a9be47b5dfa4088095f0f35827a3cc12590cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fbe955-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303295, "uuid": "aabcbb5b-7c41-4436-8b2c-897f6ea08e78", "comment": "Malware payload", "value": "1823a35170f18dc0cdf447ace69f4ab6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303295, "uuid": "3bc2f63f-aa5c-447b-811c-316fc0053107", "comment": "Malware payload", "value": "30d428098399549fe88b7baaaee412b612d4b772ce2e4713f3ddb3949b972842", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303295, "uuid": "27e4179e-6c1c-44d2-ada6-ced444691e2c", "comment": "Malware payload", "value": "37f105e016c4d180e50f2b9da354acea872a4548", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303295, "uuid": "ba2e5d6f-cd0d-45c4-b97b-1c182c957a35", "comment": "Malware payload", "value": "9cf6583105be494354478f8f7b15fc76fb343092475ee4266cd2ea8ea6a5fdc7b7db1fef172a2f456fabe0ac92085e37", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303295, "uuid": "782c9c4c-3574-4e03-aa53-8ed387a4e406", "value": "3E33C014F101DCA1DB2FBD7892F950B066AB1BB4F380ACD57884D58D4DE116E8B2B7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303295, "uuid": "8513406a-206e-4c32-8f33-77a4837e45af", "value": "1536:/s0bKQIOf7SieU6ZDvxjxcpAr/USvhWNssHj:/VKWSiebvxju4/UchWNssHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303295, "uuid": "e9cab282-5f0a-43f8-a58c-e778ca322bf9", "value": 51419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303295, "uuid": "e5c8c0dd-25bb-4e52-bd5b-739f2e08c2ab", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303295, "uuid": "75c1788c-f70d-4d7f-9f2e-660ffae518de", "value": "tell.06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b668fffd-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624303647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303647, "uuid": "2e3e5d12-8ab9-4f7f-bac7-cf6da5a6aacd", "comment": "Malware payload (Gozi)", "value": "ebda58ce60415f80968457e8548b9fec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303647, "uuid": "2b88da33-bb83-416c-bfc5-3d8136d123c2", "comment": "Malware payload (Gozi)", "value": "31a940dab7bce1146e29e59a348f2aa15fa1b30bc28ed300f6db8a28df1b0778", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303647, "uuid": "2266f993-7cfc-48a2-ac1e-fba309e0972e", "comment": "Malware payload (Gozi)", "value": "8496b73082f400b7aa4860245b76c2cbebc30e54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303647, "uuid": "c7a5143d-f45e-474c-8682-74cff751129f", "comment": "Malware payload (Gozi)", "value": "a5370f701d3fb732d9530e0423d5341d751b005bab79139aac4cf45bdd12a086cae94296f55fe0ca5f6c2c8acc064dba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303647, "uuid": "701900c4-1bc3-4301-8cbb-43b18eb8fce9", "value": "2D647C0179889030D6B262764F24EB810BBDB9651B71CECF37DC5A8E1F394E29376762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303647, "uuid": "176dba25-81b5-47f3-a865-3c148ed37c2a", "value": "cafd4f67066e4431e00f052908a506e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303647, "uuid": "0200de9b-83fb-4d70-a151-ac469ae76854", "value": "6144:oUtzB0RzsWEV3SwYwlR81T/F19W6fepyq85t:oUZKRzsthSwRRq/5W6fepyb5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303647, "uuid": "afa64c71-9e9f-4d9b-9c08-a9ec852e7fbe", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303647, "uuid": "dc4ffc33-940e-4366-a885-1c6373647c7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303647, "uuid": "1209b8e5-90ef-4c47-b8d1-8346f18132ca", "value": "vbaQueryCount.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f55458-d2c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624304887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624304887, "uuid": "bb6953e6-d17f-4565-a63d-3696b081e3e0", "comment": "Malware payload (Quakbot)", "value": "b7c87692ef9a7334e785fcdd7a29a9f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624304887, "uuid": "e3b93fe7-74be-44c7-bee3-e4b1c8d0977c", "comment": "Malware payload (Quakbot)", "value": "31c74eb44cb2a0e6be34c161926e33a66cd1cf1e4f33e6de44f9d5491a32bfb0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624304887, "uuid": "622145ec-ebc7-4051-98b4-6249d76ef8ce", "comment": "Malware payload (Quakbot)", "value": "675b059c8c3a3993c8472f4b6af3e219de9e005c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624304887, "uuid": "b2f6f9a6-e72f-4514-ae2e-6500a2168091", "comment": "Malware payload (Quakbot)", "value": "f49fd4f3833071e9bc887f46c42482d924383a285080f5191b41f222bd355bf718e8e16aa8090767edea6b1d4f6a2d1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624304887, "uuid": "f55746fa-4d57-4981-a71b-338ac88a454a", "value": "70F4CF217682E471C2F766360F64E5E10B5C74241B745ACF32E83B7F1FA84E3962972A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624304887, "uuid": "de02ab97-04cd-4ed4-ac9d-8da1b2b7b87f", "value": "d67f9ece491ca951fccd592592c16db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624304887, "uuid": "06c7e496-52e0-44d1-8f11-620dbba529be", "value": "12288:azKiZ3YOU0q2rbomA+57bEKvVasQr4sp7+9c3YpOkOgJykAUT0D6m3n7UWZHMINg:aNUG57bEKvNQ7+9PpO+JyVPXACxpkzab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624304887, "uuid": "ed79f0fb-b379-46b7-91d5-41dc709cb80b", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624304887, "uuid": "79b35bcb-f6d8-47d6-9779-114e49e57098", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624304887, "uuid": "a54b807a-de2d-4bf7-a342-2a69857e134f", "value": "b7c87692ef9a7334e785fcdd7a29a9f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6930d23d-d2ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1624305235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305235, "uuid": "be8de5bb-d901-4e34-afe5-6c0e5b66084c", "comment": "Malware payload (Dridex)", "value": "8bd9c9d9c9c89c5d9714c0767c8fc84a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305235, "uuid": "d0452acc-5782-4cf9-94b1-ceb130fc5375", "comment": "Malware payload (Dridex)", "value": "31e72c8cbaa53aa0c2c517c385bd8b2c1926eb1f3984a15e32c8b4d9952da91c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305235, "uuid": "9b534da5-2f85-4b1b-9565-c77394c29a6e", "comment": "Malware payload (Dridex)", "value": "ac0e1397e88d840a9af6353a894b143fe9d91a65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305235, "uuid": "40e9ddca-b664-4a23-b606-3827ad85281b", "comment": "Malware payload (Dridex)", "value": "be04e3a47614ac1a516a24d3fcd147838620411146d60912e02af4ef7739f34087300d7cf5dee3629545b74393f508f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305235, "uuid": "12ae084b-2c58-4f62-8518-ff730ea94df2", "value": "A804D01FEAD706CDE337AA333A5D732B62C45612DF19D0A8CE14D2FBC1B14904A81A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305235, "uuid": "2d02ce0c-a784-446c-ba0d-510c4c0a5880", "value": "b380277cbb8ae5571489cb34552d83fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305235, "uuid": "327f3b2c-dd9b-456e-9cce-3e7d7a32f7e6", "value": "3072:VuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:ZzWxkOP4p2EesvcDi6DOHPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624305235, "uuid": "4136191b-6c16-4fd0-a96c-f0000112b25f", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624305235, "uuid": "384f0f33-cd3e-4d53-b014-653a1bc6b633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305235, "uuid": "7b4c9fbe-ee3f-4f98-9467-8f461fe987e9", "value": "8bd9c9d9c9c89c5d9714c0767c8fc84a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ee9adb-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303532, "uuid": "cf24357b-ab23-4c29-9c5d-bbcb2f6e9207", "comment": "Malware payload", "value": "a636df95e7550734fb845a54652668ab", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303532, "uuid": "22b3f1ca-5c0b-4e3c-a508-00ecc2870e98", "comment": "Malware payload", "value": "326c67e1bb327b87346e16e94e2c66b6f92881baba2c08a8ec0da872bf6183f1", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303532, "uuid": "8c406229-181d-4ab6-8b61-79c224c05b41", "comment": "Malware payload", "value": "5a284193197c474bb3205d1d3a856914ce2c330e", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303532, "uuid": "d041df1a-4003-4b29-bdb1-46186a9e5a59", "comment": "Malware payload", "value": "1fcbb1e9ed73cffa257c47be53b1503de241367fa82788af0d6005e98e6c159d2502df4ee4b433bb122f0fb4d1335a95", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303532, "uuid": "15fc99f6-f29d-4489-9375-096914e482f5", "value": "E451E9CDEC60CDA827FB5D679A3DD059DCA0A41107D1C8678280AB8706617ED9C795F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303532, "uuid": "db0c0d80-f95e-4f26-8aa4-ccba0bd9103d", "value": "48:/il/xXU/qX3vW/gy45JBbvbY9I/kAj1CTtoE3m3gWXc9xFa0qp5NwPVjprWiREaq:/Kxk/qnvWvaBbvkaarWX6G4nltc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303532, "uuid": "1af6ad39-4bb7-47a2-88a9-8e6bd9c835d2", "value": 2914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303532, "uuid": "bb626163-fcd8-47e4-9ff8-c3bb4f90431a", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303532, "uuid": "67593816-475a-41ae-a7e0-057b471e0e46", "value": "vbaCaptionMem.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e864ed3-d2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624310801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310801, "uuid": "7730ea60-e8b8-4e49-841b-eddc1c4f092e", "comment": "Malware payload (Mirai)", "value": "b0fd6da650e20e48e2800323b4b43748", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310801, "uuid": "2aec4f47-f568-4e00-ab35-859b1caefab5", "comment": "Malware payload (Mirai)", "value": "32750696a00bf1fdea10e4fffc42cac5836e27eacbf6b274f0d8d68bdc6f6f20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310801, "uuid": "8be22615-2d31-4f78-af70-4c6a8c570187", "comment": "Malware payload (Mirai)", "value": "f0839a3ed0cc71f43649f9416866765ccc3bf1c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310801, "uuid": "af699027-c375-43a6-82cd-75a08833da70", "comment": "Malware payload (Mirai)", "value": "f39b0aa615e5262172887ae94173b76ad3d719d738e34dabc233c1f6e23b975c28a6f51949e56df9a862522c6c0a9025", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310801, "uuid": "e2ca7a2a-05bd-45ac-a5ac-799bcdb01440", "value": "AC531981B8D19A16CAD423BBFA2E418D332563E8D1DF3213AD252F5437CA91F0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310801, "uuid": "fc539d43-27e8-4913-9050-d33baf384aed", "value": "1536:kyW869O3GXz/z8a5O8is+9M53e536c0PKwl5pI++EwP:kyx6EK3wJs++5OR6hCwl5L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624310801, "uuid": "85f2c506-b608-4f18-b6d3-6d5d3751f74e", "value": 62456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624310801, "uuid": "dfa4efc6-d1f8-4457-9a7f-65d1149b43c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310801, "uuid": "5ca98fde-7f1e-4e83-91cf-41bf2081c964", "value": "b0fd6da650e20e48e2800323b4b43748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49c4f38-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258546, "uuid": "cfc94bd5-21ed-44f0-8007-6da7849747fa", "comment": "Malware payload (RedLineStealer)", "value": "2bef2c37f85408069a5952cd27d4abfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258546, "uuid": "4b28881b-a7ed-44e2-9329-582d937bbb73", "comment": "Malware payload (RedLineStealer)", "value": "32a56b2f71aad1b3a9b8ecb1c46ae62fac3bf3816ac27af964a9b1594702cb97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258546, "uuid": "8d2cc26f-e459-4e5a-a469-82c08e8231e6", "comment": "Malware payload (RedLineStealer)", "value": "edeb231d617f58a2b526de846b7d0de59fa3d426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258546, "uuid": "ed20d337-c8cd-4edd-b312-ffc42cfccfb4", "comment": "Malware payload (RedLineStealer)", "value": "9ce9667469cf4e71333c109d656233d15bb3bb85394a936d28d1ae3a7bda9211b172be38e4b83631eff245be4cef9654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258546, "uuid": "57f2d2ff-81db-435a-bc8d-c9dfe9288e52", "value": "5784AE11F7A0C035F2F752F45A7693ACA93E7AA16B7450CB12D12AEE5A347E0AC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258546, "uuid": "adfe6357-6ae1-45cc-bc48-9d2a5281a881", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258546, "uuid": "08a8d204-f028-45b9-95a9-34f28308d816", "value": "6144:Xg52TINwOrO224tpOGhK8nUCTBpKbWjiXLe+ObPAGGoaAsRKriC:02TwwOrOR4tfK8UCV4CGb+bPfYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258546, "uuid": "7ac3da5f-1344-432a-b7af-5816a9e4eae0", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258546, "uuid": "c8d09181-9bdb-4735-8684-5f6b39322ff1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258546, "uuid": "007be95b-737f-4ef0-b37a-09507d170af8", "value": "2bef2c37f85408069a5952cd27d4abfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181cb956-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624259143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259143, "uuid": "83c355b8-3130-4f4d-86fc-0a28e7d96cd5", "comment": "Malware payload (RedLineStealer)", "value": "8f8ea294d5df1ec9cb1f6bbe545a39eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259143, "uuid": "8d9834b6-2d9c-4edf-b20e-379d7b1035b8", "comment": "Malware payload (RedLineStealer)", "value": "33d32be47c6fe9ec4b94d7f7bfb5381fdb6854c8f2a74ea91e8583035b8a592c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259143, "uuid": "be48d738-fb90-41e8-8d26-f4ed4a31268e", "comment": "Malware payload (RedLineStealer)", "value": "017242ebd74e8430482833a1659afe970d1b40c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259143, "uuid": "037542b3-6a9c-4464-9271-d589a38010fb", "comment": "Malware payload (RedLineStealer)", "value": "efb630573f220b2e54879911e46a85d26e0a1685444c06858c5f64d276a8886e1d4478e38e8489d95168eec1b552f437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259143, "uuid": "3e5783d2-985a-4684-a5a5-62c0eb11261f", "value": "C884BF11F6A0C035F2F762F44A7693BCA93D7AA16B6050CF12D52AEA5A347E0EC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259143, "uuid": "5bf64225-b2b9-49fc-a91b-04e5927e7df5", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259143, "uuid": "eabeecb9-125f-4c6b-8b20-8070ee2245d1", "value": "6144:kgD2iIcwUrO2k4tsOGhK8zEKldWnkVxoP4suzddCG/oQLsSp9Krif:h2idwUrOj4tsK8wuMkV2Fu5d4cTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259143, "uuid": "58feb588-d0c4-43c8-9f8a-cd612efbc948", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259143, "uuid": "620e4a9e-8434-47ae-a734-b28f816b562a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259143, "uuid": "d76d01db-ef03-434d-af2a-6df9db0f250e", "value": "8f8ea294d5df1ec9cb1f6bbe545a39eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73420541-d242-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624246840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624246840, "uuid": "5f481f75-3723-48c2-9d9f-cddcdf196376", "comment": "Malware payload (RedLineStealer)", "value": "a91a8ba95016cc37d55b61ca8639c018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624246840, "uuid": "f0be66f9-11bb-42ef-95e0-5e51d32fbe91", "comment": "Malware payload (RedLineStealer)", "value": "341041d0a586d0c8cc0f8e9b870dc3961fb95ea2593497df88b40cbed79813ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624246840, "uuid": "a699afd7-b865-4424-9855-0a37ee728b05", "comment": "Malware payload (RedLineStealer)", "value": "33eaee28189a2e66d1fa5bb88ed6b2082c16f238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624246840, "uuid": "e4538d33-b17a-4a1e-a7bf-9ed7e979d3fd", "comment": "Malware payload (RedLineStealer)", "value": "27c40c568e9f81ba40cbbb85527e13ac69bce76741d50def854ed13f8f7dfc596bc4235166376bfb30fe67392c7876c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624246840, "uuid": "7271f0de-b1bc-4ff3-a9d9-1e9b0bb2b4c9", "value": "DA94AE10FB90C035F6F762F85A7593B9A93E3AA1A72450CF52D51AEE1A347E0AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624246840, "uuid": "06c3e65b-cf56-4923-ba73-26c90a5a28fb", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624246840, "uuid": "550df1d4-c1b1-496f-b67c-6c343ee30966", "value": "6144:fd8E0IClHkxguD2STkppweE82vglaXVDn68vQnJIkHMtL5yKriT:z0VlHkxguySgp7QkyBZQnJ91l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624246840, "uuid": "7d2d5af8-84c6-4995-b0b2-a523b5b929f9", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624246840, "uuid": "41d06abe-f72e-45bf-99fc-28407fdb367f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624246840, "uuid": "47c1c155-9969-4a59-8f1c-438e1999cc44", "value": "a91a8ba95016cc37d55b61ca8639c018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f8b2d0-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624259086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259086, "uuid": "4447af9e-dd6b-4a63-9177-ce74d4d30807", "comment": "Malware payload (Gozi)", "value": "048b54087505b524c9e4c5f4e1394afb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259086, "uuid": "c14ec164-f2e5-4175-a82f-fc83a156a67f", "comment": "Malware payload (Gozi)", "value": "345ab39b904f12eeadb6b22abb93155b8fe4a0c33309227332c63c96447dcca6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259086, "uuid": "73de64bd-715b-4cdf-a9cb-3c49b7987a7b", "comment": "Malware payload (Gozi)", "value": "0c74e30542a1de22aa48413e493f6906668553df", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259086, "uuid": "706ff7b5-6bf1-4cd5-8cbe-d90786f3cbcd", "comment": "Malware payload (Gozi)", "value": "5b5a5c6e093a77543221c70287461a064875853ab6c2d3ba2cbe6ca3353ea9b1e4c1ba9e1a7deb1029e922c0f3127fb7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259086, "uuid": "971d7702-3b72-4c60-ae6a-1f18f60a5b54", "value": "DB15C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259086, "uuid": "bff63fa8-9e43-4127-8d2b-34a4706ab8fe", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259086, "uuid": "2321a667-c021-4cf7-a35e-aa059b45008d", "value": "24576:HQfpzjXPgfw8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgkJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259086, "uuid": "b7226565-c196-4da1-b321-8046e0cce8de", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259086, "uuid": "3a481eae-e915-4a18-9226-01dbee43f6ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259086, "uuid": "efdca029-e690-4a7d-9243-416569433f5a", "value": "048b54087505b524c9e4c5f4e1394afb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3476bfc6-d294-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624281954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281954, "uuid": "ae6fe69a-b9ae-4461-89e1-286c917df45c", "comment": "Malware payload (CryptBot)", "value": "74ce19f57a233957e63d9e7b56ebaff3", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281954, "uuid": "d85fc312-98d7-4838-9b33-9b37448246fd", "comment": "Malware payload (CryptBot)", "value": "34bc960d8c4dc7cf48a127c9aba200b16e0ca72783eb3c592f26fc1cf314fe48", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281954, "uuid": "c9d7d5e4-a0a7-4313-abaf-d2c5bf9bb0fb", "comment": "Malware payload (CryptBot)", "value": "bbd32af1dab79e4bc08e0e7ed9860d43e38226ab", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281954, "uuid": "f96ce151-6c09-4142-8a27-1ed834de03a8", "comment": "Malware payload (CryptBot)", "value": "098114b30e41a34e840b81fb6ead7d6de9342584be86facebbdb1172c4059feb936931da5b39bd06d6b5e9ee25fcf31e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281954, "uuid": "bac33eb1-0228-41c7-b0d9-d2b4f96e900b", "value": "4F05F110B691C039F3FB52F84979C368A53A7E615F2640CF12E926EE1A747E0AD31B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281954, "uuid": "2c55aabc-4d02-4a09-b4b8-bcce4217fe39", "value": "b067534ac0be7011ca2eacbb5ad9dcfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281954, "uuid": "ace3334a-0793-4796-aabb-e5ea92c36b6d", "value": "12288:llHueG5NFecwa8j9jKUxUnginsZ3hQeRkBDQbJlBWPq0MTz2+xj8jHnUtl:zueG5ZUj9jKTgisZmM6ndMO+R8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624281954, "uuid": "115c25a5-a517-4463-89cc-87764b0d37ca", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624281954, "uuid": "11c469e4-a199-498a-9a2c-7bd6fa5acb4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281954, "uuid": "9aaf80ca-e985-49e0-83d5-db5968fcd7b0", "value": "74ce19f57a233957e63d9e7b56ebaff3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09352612-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258259, "uuid": "54e992a2-42bb-43d6-bf26-4ebeea6325d6", "comment": "Malware payload (RedLineStealer)", "value": "1aa0c6a1c991d857b03f934044a8078b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258259, "uuid": "df60b6ac-7b91-40f9-bdb6-cb7dc5728407", "comment": "Malware payload (RedLineStealer)", "value": "350c33bf46734a998f41619aeed51bd132d38d72b4cda51b9034b8dcd6340d9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258259, "uuid": "4f1dec30-ff80-4005-817d-684b969aa007", "comment": "Malware payload (RedLineStealer)", "value": "95e2a0a0bcbef3a65d5190d7e4765467434d98f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258259, "uuid": "e96fb27f-f1f3-4b3c-bd09-87937033a2cf", "comment": "Malware payload (RedLineStealer)", "value": "0800de13c4a5d9f4ccbe2b221522c8775e6983faf92bd6296df8e8e89c0e366855c863cdde209483a7c7e9aa3884a608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258259, "uuid": "93232525-9a45-45e6-8889-05cf309cf5c3", "value": "C284AE10F6A1C035F2F761F80A7993A9A53D7AA16B3451CF12E52ADE5A347E0EC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258259, "uuid": "5df5a2fe-fe52-441d-ab16-13739899039c", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258259, "uuid": "9151dad5-de08-4248-a866-aebfea8f7551", "value": "6144:WgT2NIBwErO2U4tHOGhK8uHJ0XLe2eyl/sxYQXP6KDaBfL/jH5CHoUYsvH8Krif:v2NwwErOT4tRK8GwqgsxyKGJjHxicl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258259, "uuid": "6742e067-006b-4db3-811f-552b49a41fac", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258259, "uuid": "aff012c6-f35e-46f3-8559-dc84c48194a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258259, "uuid": "5852109c-fa46-4df2-b457-abb73290051f", "value": "1aa0c6a1c991d857b03f934044a8078b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd658d5-d295-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624282537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282537, "uuid": "be167d4a-ec09-4637-9d06-081b4efedfe4", "comment": "Malware payload", "value": "02c5f2b42795f3a21f92cc169029c54e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282537, "uuid": "1e17b167-f390-4a10-a2e7-30a61e564fcf", "comment": "Malware payload", "value": "36505e343c0eea5e291f141a3100f65123832b8e6d03c19d91b367dd340e0754", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282537, "uuid": "b4c3111d-0ddc-4a83-a301-c10edf8733d7", "comment": "Malware payload", "value": "6065b1968cd2f6df83cd218b3018ba2c965865fa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282537, "uuid": "846e8abe-216f-418f-a636-c3ab065fab11", "comment": "Malware payload", "value": "8b89ec01af4b89f8be7eb39dbef2e296c855f559c1df878ba319500e46059bee5d8238eed912a279a5f4ae4b0d641563", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282537, "uuid": "a00a2698-3dcd-4259-b124-8f4740d6e159", "value": "DD810A291A462C03EF0D99FB8122FEA655E0F0D546CB119431BFE5F6031B3916AB6882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282537, "uuid": "f81ad84f-471a-43d7-b5cd-2e9c3410c487", "value": "48:gT6ty5883UsIlXz3uikRzyn755QvNnJ6WIcjEyzL9sg4jWmVQtcoovaHJ5LA3wX1:6LdTIlXz3Ljn755Qn6AP5wGFwHL9XM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624282537, "uuid": "33487561-ae6d-44d4-be73-7583bd29f9ed", "value": 3908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624282537, "uuid": "a1ae0d3d-8b77-4477-a2b0-03a172cace46", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282537, "uuid": "cbe1f9c7-a9a4-42e1-8053-8a5f1739f992", "value": "PI. BT-GJ21001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68abf249-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624287195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287195, "uuid": "f380fe68-4884-4e1d-b93c-3718ada22f31", "comment": "Malware payload (AgentTesla)", "value": "b7e7c5950b04715386822a2787bc5f9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287195, "uuid": "8982514c-d4ad-4b61-b38f-51df9cc4438f", "comment": "Malware payload (AgentTesla)", "value": "37534d1bed90b4a2b138f6734968b2acd4a2629c117edd680e3fb52c4afa739f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287195, "uuid": "6b0ce3e3-c83e-4a03-a25d-33a1febec901", "comment": "Malware payload (AgentTesla)", "value": "5f0d7667fc5981a2d766ee1c42cbb25934d8dd50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287195, "uuid": "b28a6ad1-a7d5-4d61-94c7-082a1917f1d6", "comment": "Malware payload (AgentTesla)", "value": "e94d2fc1da2e7ac1f50a58d547a449cdcbfc902f94de92a85755a4a8cc4281f5e0a867b22ea84c9f02cfcd64cd0125e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287195, "uuid": "4a9451b6-ba68-4e7b-b0ac-005f631812ff", "value": "2B358EA0B190C89AF97F4BF16D6AB43025E7BE5D9564C10C29A9770726B334220DFE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287195, "uuid": "cd32fd50-9390-466a-ae2d-a7764be81094", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287195, "uuid": "f13dcdcb-b69f-4eba-83ee-791f599810c2", "value": "12288:RDrJWFHmssiGHjW4W8gd7ui2gjbHZL5sA0ZuCLLOosrowFiQiYD2BxuCLWYTl:laHaiGHyVZTH/wuaxsowLizBpLWYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287195, "uuid": "91c9edfe-bf37-429b-8fd5-503ecf415c1c", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287195, "uuid": "faf8e48a-c74b-4564-b9df-a1f2fbc49604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287195, "uuid": "c3e4da5c-1ff2-4820-955e-321a7bf6a2ab", "value": "b7e7c5950b04715386822a2787bc5f9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b7524e-d2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624289452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624289452, "uuid": "38e4f674-4bb2-4315-81af-641c0611e194", "comment": "Malware payload (Quakbot)", "value": "53f563d17135ccce3cc945bab947a49b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624289452, "uuid": "10ecb352-58f9-47d6-8b51-a4e4e909d2dc", "comment": "Malware payload (Quakbot)", "value": "3786f30bd73fdd01bbdabecad82886bc21133ef9ab0cd4f50c217cb8761e1f05", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624289452, "uuid": "e2b5ef40-a827-4648-bbb5-b1339d187e15", "comment": "Malware payload (Quakbot)", "value": "bb38d2034f285651008c053919e9ce46b0c92fe5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624289452, "uuid": "8d9e325e-59db-4a95-9f96-dd6c77087e41", "comment": "Malware payload (Quakbot)", "value": "0419d1246f455742958b9c5bac58ebabbf609aaf313ffdbc22ce651dad270678f16d7b73d65225a9cce70709a9baa2e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624289452, "uuid": "f0504257-cb23-4855-9128-3b20447b9b08", "value": "9D74137ED68169BCC339CC3ED240A1E48119F2D15097B22E06DC351CAB572DBAB9E2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624289452, "uuid": "2ad2af71-fe4e-4dac-a44e-4fffcf697fc5", "value": "6144:vSRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNE:vSRMmEv2Bc/nvm8IKABfsYOmauFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624289452, "uuid": "639d61dc-ff11-4000-b082-8743555911f7", "value": 358072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624289452, "uuid": "efe8d2d7-18b1-4db4-b770-5f2502eb01d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624289452, "uuid": "5efdf9c5-d59b-454d-bc25-e56f41756d40", "value": "Compensation-1456624320-06212021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb80599-d25c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624257974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257974, "uuid": "d55c9895-0adc-4751-b2a1-015c8f978129", "comment": "Malware payload (NanoCore)", "value": "6b9077b1dbf725c86570855ae4c7105f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257974, "uuid": "ba139de7-3ee2-4e7e-beda-ea856a83b0d0", "comment": "Malware payload (NanoCore)", "value": "37956e4a54f70235fa01c97d058f98e06c2ae5115bf5d8a77cf7a0b262582b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257974, "uuid": "6f8a91e4-435d-4549-8607-9c4ddb42f23a", "comment": "Malware payload (NanoCore)", "value": "66adc1729650be75be67dfefb64093bc46b89a0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257974, "uuid": "12605e9b-93af-4e62-893e-791985217c4e", "comment": "Malware payload (NanoCore)", "value": "a9c869f1893b5b07b1145bae83aae5c9f762b1611d6be1cfbe6149f3ca5e8ba0895aa148c3d18526039875b76f250951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257974, "uuid": "30e05962-1c1f-4888-bc0c-00fa7c4423d1", "value": "0FF48DAC315475DEC62BCE76CAA82C24AA207877531BC207911325DD9A2DBD7DF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257974, "uuid": "9620d7ce-6b86-463a-b38a-37434f46c166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257974, "uuid": "a7025cce-2c08-4acd-8160-30834755af60", "value": "12288:QwLMbGs2Dq4IGeNPB/ZzTyPNeMo5K/aywwlVWoxWAal0OGKH7SYYTO/Q9y2zGzWS:5MJZB/JUEMo5KyBiVWnAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257974, "uuid": "113e858a-bd93-4585-8c7a-a033f600cfbc", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257974, "uuid": "e06c6183-244b-45f9-bea1-3bcbb601a550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257974, "uuid": "bf120e86-e636-4cc4-8b09-3193103aab50", "value": "90a7AVenPkystHQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c42055-d272-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1624267590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624267590, "uuid": "f43234b1-222c-4003-9acd-0846f1b4ca9a", "comment": "Malware payload (IcedID)", "value": "b22c0344515fb985100a02f0e3bb5845", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624267590, "uuid": "48e42ea1-c390-430e-a308-82729d459e1b", "comment": "Malware payload (IcedID)", "value": "3839ea5f86c4ebc8036ab26cfee2b0e05893a6b276d39ba23b75980c4db4c8a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624267590, "uuid": "29a41be6-4ac0-40fb-bfb1-245270047035", "comment": "Malware payload (IcedID)", "value": "725c29b02c040ec7fa3f5790716073f3ede3e0c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624267590, "uuid": "4fa4967f-a412-4d93-9e94-351b9be993bf", "comment": "Malware payload (IcedID)", "value": "ee75080c169265b6574483b213fd8a9a4015a8f6d7f7d7c715677a814de6dd3f38196beaeef5473c9c24ba242dc6571c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624267590, "uuid": "90dcad7c-3c6e-4dc7-883f-5115f74d6fc7", "value": "308302CA676EABE3C5DE683771686374D0B1614E8BD5F0860584D7DCB78B532683B340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624267590, "uuid": "d30cf39f-9a31-444c-904e-774a488960cb", "value": "6859c1fbd5011b39e2b3c5ccd6eda491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624267590, "uuid": "34449c07-f831-4ca6-bf36-548426ba78fb", "value": "1536:I3Q/6OpeJ3iNXz+jyJnGSzgNemxTlytbbGy5olhBMDFMQexew6dwM01P:0ApeJSNXCCPGxTMwy5o8Fnp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624267590, "uuid": "9baf6667-b555-4a06-aafd-783f5bd1f95e", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624267590, "uuid": "2bedc1be-7adc-48ec-b4e1-6abbcbbdf614", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624267590, "uuid": "366366e1-e55f-4e39-b931-1c079e01f716", "value": "725c29b02c040ec7fa3f5790716073f3ede3e0c2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07927f8-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284417, "uuid": "44b9c4f4-2293-4526-8eb1-a7823b72c1e7", "comment": "Malware payload (Gafgyt)", "value": "e6e78cea07c1edfdc80f332b1d01aed6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284417, "uuid": "695b0de6-eb32-433e-b821-5611034053d0", "comment": "Malware payload (Gafgyt)", "value": "38ac8a460bbfc0d462ebd4eb4f888775364216ae35f328381d446c03fa64ec93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284417, "uuid": "7ccdbf83-7b94-4e5b-a340-eda3ec80e5c9", "comment": "Malware payload (Gafgyt)", "value": "d6c07903dd5f7b89820bb54d1d058eb13644bb24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284417, "uuid": "14b12e4e-4e52-47db-90cf-ac9072d25e87", "comment": "Malware payload (Gafgyt)", "value": "0f70bfd516148387ca87afb69fdedb040fe9415ea9a1b29cdc80b3358c8b0f6374fa5cf587418d74563a3163eed6b635", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284417, "uuid": "af7f4a4a-291f-49de-80b1-c60cfcbc60fd", "value": "27A30A41F9408717C2D227B7E7DF439C37365A68A7E7331566346DB42FC27982E29620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284417, "uuid": "1b68280c-f045-4cf3-85a9-5955703585bf", "value": "1536:K5Aa58cQE2ofUgp1uaIrVWdu+ltOH68/gKDqBmwkqBoBbSQUdgYrzpim:Vcu0U7r/+z8/gKDS/BoBbSQUdXrzpim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284417, "uuid": "d6829534-4777-4d87-8b38-1878e8cf1fbb", "value": 98066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284417, "uuid": "bc76c12d-f0fa-4288-a28d-61ffb0864ebb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284417, "uuid": "13d46922-b7d4-41a8-8552-c646c50badc9", "value": "e6e78cea07c1edfdc80f332b1d01aed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf3a7b5-d256-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624255364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255364, "uuid": "0dbd6942-d51a-406a-8627-4613141bdc83", "comment": "Malware payload (NanoCore)", "value": "cd085f21bb5a77abfd9c7e0c92588116", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255364, "uuid": "b62b199b-918b-4c26-9ab3-77b954be8f8b", "comment": "Malware payload (NanoCore)", "value": "38fe01f866b2116a3d30206556030ee2526f645d0924981589d1bb1e873adb2a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255364, "uuid": "29fc1eb0-04bb-41ae-aa11-9b00fe7f6173", "comment": "Malware payload (NanoCore)", "value": "ae27984d7978dd0deff6a20a1f54692dcc3549e5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255364, "uuid": "25f617a9-e720-45c5-bde1-7162abbff651", "comment": "Malware payload (NanoCore)", "value": "92fe689f504a9e7063756290aeae4fb4d854360024fcbb5d43bd2d510d4b0152d60a612f66121c09a445a19b3d9e1931", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255364, "uuid": "0b6ed334-3caa-43ca-aeff-c942da52cd33", "value": "C9C423BD758C8518486061049DABDDE260E07BDE5393F17C6053BC8F637627ADAF482B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255364, "uuid": "4a7260b8-06cc-4a29-ba86-b43a58624c46", "value": "12288:fjtDjWqcz9I4ZV5j8Yt/ln9uiByabCeds1/dh:7FWqs1V5dtDMgUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255364, "uuid": "f7af15a8-9c13-44e8-b3d5-b4690ff921ec", "value": 591288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255364, "uuid": "451c83cf-1424-4af1-a939-7727acbf4b30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255364, "uuid": "0130a3b4-3788-451d-9f71-17f19f7077b9", "value": "P I.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa9072a-d2c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624302374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302374, "uuid": "384b5f77-65c8-4088-b36a-f17fd70eb79b", "comment": "Malware payload (Mirai)", "value": "37f4475778c681f905748326179aa325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302374, "uuid": "e8322062-3ff5-4169-bc33-e0a048b8a291", "comment": "Malware payload (Mirai)", "value": "3933514588db79e78da45dd79f7d4b13ee55485ba350bdd243c456a76ffaaf61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302374, "uuid": "3f328626-fbf9-48a4-9102-cb26c051173b", "comment": "Malware payload (Mirai)", "value": "0637cdbcc1e356635e44cc3809a06ec3aa044f01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302374, "uuid": "bb9cd58b-2623-45a8-ba1a-4b8e134d71d7", "comment": "Malware payload (Mirai)", "value": "d5d936306a9f435fdf54acbf155899a0e8fdbdff82b4f01834f70f7b86900bccc2be8999ab6be330f91f93272ee0ec93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302374, "uuid": "f92169b6-0133-4bc7-b82d-ee0753008711", "value": "44E3283B2B131F23C1CA147156E70372ABB5D64438BC9787A9A06DEC2F17AC839563D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302374, "uuid": "b015eb09-0941-426c-acaa-7399f769c14d", "value": "3072:m0Bf4N85gZCUvwE54RaHIVqz2Fmmza9bh0I+agDl:m/+CDWRaHPmza9biI+agDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302374, "uuid": "3ef44dc9-1541-4029-9c41-20ce187d06b2", "value": 145079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302374, "uuid": "4ca8918f-560d-4d53-8adf-75cba8bc59fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302374, "uuid": "4e9212f3-0233-490d-87ea-47cb4d2d0766", "value": "37f4475778c681f905748326179aa325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729179ae-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258865, "uuid": "945d0ab3-764a-4749-87e3-67a3651229e6", "comment": "Malware payload (RedLineStealer)", "value": "c48c2b35abb80cb019b5f992c740e012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258865, "uuid": "62a330aa-993b-4eef-8512-d1aad6f96ec1", "comment": "Malware payload (RedLineStealer)", "value": "393b838448bbfc184a018d6aedd6f28a38226e60a45bbd7df441f05298be45d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258865, "uuid": "dc5b4097-8c00-47ae-b863-b52592f0fd1e", "comment": "Malware payload (RedLineStealer)", "value": "ee87937bb5936bace300a456c67a8b8044bb40ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258865, "uuid": "45e2195f-2c36-4f60-81e2-a42ad248a051", "comment": "Malware payload (RedLineStealer)", "value": "c3cec795e90fa035fc978efa529d6347e7ed1e99c81238f69e3c20eea372bc643b1c1787250ff5b6fc6ca74c5cbeed95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258865, "uuid": "ce989c8b-743c-4a75-b291-01b763def871", "value": "AA84BF11FA90C035F6F766F44A7A93BCA93E7AA1673050CF12D52ADA5A347E0AC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258865, "uuid": "f4be1687-f3b8-4a7f-8f01-2d2c1dd5c59f", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258865, "uuid": "6c8a1426-85ff-4c5a-aaff-c9f5db92978c", "value": "12288:923ho6iJR4tyK8ZGRQ7wDh1uG8oIHQPnbchl:98o6iJ9NXSh1uGzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258865, "uuid": "9c9dc36a-6494-4f56-ab8b-b1cb34a36902", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258865, "uuid": "cf6c8ade-6961-4e19-9601-e9e3cca39ef6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258865, "uuid": "3eeca328-4252-42a9-8264-39db2198bc40", "value": "c48c2b35abb80cb019b5f992c740e012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a03fec2-d2c4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624302686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302686, "uuid": "f57b1228-e895-4cf2-8ddb-5eaa7eb34df9", "comment": "Malware payload (Mirai)", "value": "8a582c55a1bacff27043cc2748b46a85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302686, "uuid": "b0348695-2631-423f-8228-4a26e8457118", "comment": "Malware payload (Mirai)", "value": "398e5af220cec8d99de216c676d35298e30a37cc7e2369bf1be2031c046a7692", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302686, "uuid": "51936da4-dc1a-45e1-a98c-fd026497994d", "comment": "Malware payload (Mirai)", "value": "38b3199ade55f849cd335c55d928093475e2ac21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302686, "uuid": "84f953b8-b25b-442d-b368-6cb0b05bbbbb", "comment": "Malware payload (Mirai)", "value": "b724a292e63006f5c87e894f1a4a43161207fa2e78bb2553f0723081bd4cb025cec56dcb360b68e087520a5f1a352d7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302686, "uuid": "8157e72c-fb09-48fc-afbc-786c91347219", "value": "71330212525E465BC7E6833B537E8CBFE47E2A954E35948A77210ECF38EE3014128ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302686, "uuid": "8b9c6c5e-7ffb-488f-ba9f-1115b12fb683", "value": "1536:b5xmCZ7pzTpVT0o74PvonrnJOwQdu0vNL:bDjZVgoUgrJOwQdrvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302686, "uuid": "7d139b01-3f64-46b2-aa31-a0c6516a6631", "value": 53516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302686, "uuid": "1ee47a97-0418-4b1f-99c6-65d15a74cd12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302686, "uuid": "b0e9cba7-3e30-4952-b6df-167458254ef1", "value": "8a582c55a1bacff27043cc2748b46a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34765392-d2ae-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624293121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624293121, "uuid": "d6cee03f-e907-48a2-87a5-371dcf21f89a", "comment": "Malware payload (Formbook)", "value": "755fecce9e86d0d2ba12f018b2d4708c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624293121, "uuid": "5348c352-1495-4b30-b046-cc9ba1952866", "comment": "Malware payload (Formbook)", "value": "3a35df53c702f348d3693309c29fe3044d50ecf4be8648b787e74f79f5d2ceea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624293121, "uuid": "c234a3d1-a676-405e-8c1a-3a3f87ae9772", "comment": "Malware payload (Formbook)", "value": "940d9ba59f5941f32ba5353cb1149075c3b7081f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624293121, "uuid": "042251d5-ba8a-406e-a404-8c58a11c4da5", "comment": "Malware payload (Formbook)", "value": "af167662f978f65c87fb74d771edec274c56ecfb0e75a4a412b2e5576979e222619c564c2ca1b06accc802581e6c76c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624293121, "uuid": "9f2eef07-69c6-4dbc-8f33-ad2c29d6efcf", "value": "E224126239E189F7E18E24B11C3FE7A9F7BEB244012299DF0B901E3F58611EB5D4A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624293121, "uuid": "5ce55a3f-3675-42b2-9336-f562afdfc904", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624293121, "uuid": "61dd663c-121a-45f4-8077-cf4f0889863e", "value": "6144:wBlL/DXBCXBzM/p78G89gCyvt7riCxFg5UA7BlyCuRYX:CBX0xzMV839w7rij53yCuRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624293121, "uuid": "9fdd4119-7d43-4164-a62f-24b8366afcc0", "value": 227634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624293121, "uuid": "8410a9b3-a69c-44f4-890e-15993e266a3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624293121, "uuid": "aa3708f2-5ed6-432f-902e-936282a78791", "value": "Scandocument2021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f786c40b-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284428, "uuid": "fe926757-b8dd-4722-bc0f-f21f4d1e96c7", "comment": "Malware payload (Gafgyt)", "value": "0a0aa720b5493a2b418a36e216893866", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284428, "uuid": "9f862062-bd22-408d-9bff-cce65f7cf606", "comment": "Malware payload (Gafgyt)", "value": "3ae7925dace540bda3c27e911c1a41fd6ff1e87d540cc3c35b8e4cb62e295499", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284428, "uuid": "6749d235-33ee-419b-bfd7-31838117889c", "comment": "Malware payload (Gafgyt)", "value": "9057a0cc3be84c335d2ff402f2463af12bd415d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284428, "uuid": "5ec33317-0851-481c-8aa8-b93959cdb06d", "comment": "Malware payload (Gafgyt)", "value": "e3c7c7cf05bbe61b9d7212aaa48f9fab85afdc3a2d26cae3b0e10de878577238e8e9a2f5a4c517edc59a75e8b4a4f3fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284428, "uuid": "51075f52-27f4-433b-9021-272439dacec4", "value": "EEE3A52E7E21AFBEE268863107F75F70939521D236A19342E26CDB185F7128D1C5FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284428, "uuid": "b98eeb80-2692-4160-b109-85a54e346b2c", "value": "3072:6WPUr6+aSCcEZG75hVO5F3x6wqY1o5Bmrm:/Xbi75hVO5F3x6wqY1o5Bmrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284428, "uuid": "4b621724-6a71-4402-9ad6-e7874ecc41bf", "value": 150714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284428, "uuid": "e90d1dc7-ea02-4a9e-ae8c-62185b72d553", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284428, "uuid": "b150cde5-805b-4781-afb5-e61c40eb923d", "value": "0a0aa720b5493a2b418a36e216893866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745e0b3f-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258868, "uuid": "f60b4ef3-9360-46de-9b12-8ceb88e491c3", "comment": "Malware payload (RedLineStealer)", "value": "c6670c01194279d25246ac4b9e2a9267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258868, "uuid": "ee04bf25-d461-431c-a56f-8229c66722a8", "comment": "Malware payload (RedLineStealer)", "value": "3b6987ad36e2617a95c2f71e718ae689d7070b29d4c35402043d4c4443092283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258868, "uuid": "a593646d-ed04-4aaa-8246-4e1ea8d4219f", "comment": "Malware payload (RedLineStealer)", "value": "590ca47bcdbef59ce044b973affbb9200114ecff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258868, "uuid": "33133ae8-0ae7-4ee0-a860-da57da90e343", "comment": "Malware payload (RedLineStealer)", "value": "57ae524412947fd0a95023d6fa4aecf324b9e83107c1cfc3bc0b5a2d5634b8900fa8952465c91834de816022a4092426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258868, "uuid": "2505ac93-20a7-4d69-9daf-77be4de82dcb", "value": "4484AE11F6A0C035F2F762F44A7593ACA93E7AA16B3450CF12D52AEE4A347E1AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258868, "uuid": "9eea376c-dfc2-49b0-8f32-4ff6ea2fad01", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258868, "uuid": "ab1de539-c3e8-4c01-93ad-f71b92a1e584", "value": "12288:329wwUrOj4tsK8HxcH8JO+mjo2V2EUejlG:3zwUrOJY0O+mjogE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258868, "uuid": "ceb6f338-64a8-4ce7-8656-d2784701d897", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258868, "uuid": "cc12287d-53fb-4af6-9959-5fea9e1cfeb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258868, "uuid": "28654027-d1a1-4611-b885-473a0d9a82f9", "value": "c6670c01194279d25246ac4b9e2a9267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e909e1e5-d295-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624282686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282686, "uuid": "75a17ebd-3bbf-4693-a1df-6beb07c79ee5", "comment": "Malware payload (AsyncRAT)", "value": "781a9b38b8068ec7da460d83edc33517", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282686, "uuid": "0b9cfb8c-e153-4ced-ac7a-1db092b4d84e", "comment": "Malware payload (AsyncRAT)", "value": "3b92ae2fe748adc2f70f7cc4b28c37dde13997bd38916b11b1b59dafbbba4f6d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282686, "uuid": "76be7ba0-ffda-4cb6-a63b-a0369971cbfc", "comment": "Malware payload (AsyncRAT)", "value": "08b2b7f8be175bdcc7ead4dfd84e86a9f3ab02fb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282686, "uuid": "292a8144-a4a7-4e23-895a-398baab0ef25", "comment": "Malware payload (AsyncRAT)", "value": "9cb989590041a0b76f32c8f161af1da6a2f7addb619cb1af1ffdba3e80bbd20d97d8a70b2fec3c9133d43dceeae4da0e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282686, "uuid": "62ce7da4-7639-4c60-872b-7f57a5e86a43", "value": "39E02B1ACF818C46BB0DB2DD458BBC46DA9881B00FB8B409B145CC0478BD9BA0F349D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282686, "uuid": "233add00-674b-49a9-97d8-f1074848a6ec", "value": "6:0NOMpoNKOe8ZcANQXAYJ29d7sovPmVWY4o5RhOCsKmgI:0owQ3+AJY29HEp4oTVsK7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624282686, "uuid": "b9dd5a69-c053-4692-9f2c-baa976b0ca57", "value": 294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624282686, "uuid": "32af0a2e-eb9c-4a78-9238-34397298d920", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282686, "uuid": "2a009e17-f0d1-4c14-aba2-8a36321b472c", "value": "21-JuneInvoice_ID744346480666279.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080429e6-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624287033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287033, "uuid": "16b17b87-0b33-4f0e-a1fb-6030794959c0", "comment": "Malware payload (CryptBot)", "value": "61012c70facf5f68e9c9922661cbff69", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287033, "uuid": "44808af6-722b-45ce-966b-9b988a070efe", "comment": "Malware payload (CryptBot)", "value": "3f78a2cd5f4f17e687e17c494cbf953737c8d8bd5f31ea1047c8d2580d1adb3f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287033, "uuid": "4685779f-0752-408f-9a8a-c2f62946685d", "comment": "Malware payload (CryptBot)", "value": "b575c6dabab4e8ab0c9a8300c40c67e018dc569d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287033, "uuid": "531a52b5-453f-4154-883f-f101ae3c85eb", "comment": "Malware payload (CryptBot)", "value": "a49a451b4646b580d89f7654c31690b5b670c16e50405cffe8f14e553226f2f9c695e32967414fa27bbbd9cea2bba6df", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287033, "uuid": "a14fa7b1-b0ab-4c39-accb-359058c7574c", "value": "AA05F100AA50D035F2FB61F449B693A8A92E7D615F3A44CF12DD27EA1A707E1AC31F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287033, "uuid": "ce13a710-089f-40f0-b7fd-83bebd01b200", "value": "b067534ac0be7011ca2eacbb5ad9dcfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287033, "uuid": "17a65c54-de84-490a-93fa-f49ffd5bd304", "value": "12288:KnTuwG5rFehwaMaX7/eSVSy03G3j08daPHF04mydq1vHwFkl:muwG5W3z5VSyrAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287033, "uuid": "3ae75aac-6363-489b-aa95-525d8d024e25", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287033, "uuid": "6ff3a329-2645-4e15-93f4-c592eb9daeaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287033, "uuid": "11e18dd0-0513-4b5a-a388-8c262ec35a9a", "value": "61012c70facf5f68e9c9922661cbff69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cab0ab7-d2e3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315871, "uuid": "082ea1e4-f4d0-40e9-a3dd-b2935a918e6d", "comment": "Malware payload", "value": "eaa8af7a80070549c4ce6e9bfc789aea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315871, "uuid": "a1588c3f-09ec-48b9-bd2a-2fffe4e0545d", "comment": "Malware payload", "value": "4029e74468c92f45602e675f3f3ec1b45489ca962f36700434021ddc0e3acc26", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315871, "uuid": "5d233844-3fc4-4c22-8ae7-2407d8ed29d8", "comment": "Malware payload", "value": "55c087e1eec7507bdc0353bc2225e8e2a331bb84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315871, "uuid": "cb854fcd-1bd1-4bda-b0ab-dfa90fe9b344", "comment": "Malware payload", "value": "a89701431da97d931706d04ea65769e459f5fcf217e5c2a5000152d73f1a40b58f2b8c4e4c76c6be3dbbdcdf95cd3f3c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315871, "uuid": "317001f1-46d7-4f5c-ab72-607d8a1c517a", "value": "6F04D026E2E556CDD24716771319B3373214F42A42EAD2A3FF2CDAD2C097AF84414D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315871, "uuid": "765a45ca-0017-4b7f-a5e2-8b0bccc816fe", "value": "14c75779b7b4d62acd0d37b3afcd3c4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315871, "uuid": "15e7522d-1838-4427-b22d-5e3cc6301c0f", "value": "3072:ZZUVAk9rsXo3/Ifz/uUXF2mSPBxv1tM7lt8jPU6/pyagsuAtyUucGZ2:ZUAk9I4vgz/V2dulz6/hvrhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315871, "uuid": "ca5d23ff-99f0-44d2-b49a-3cd82664833b", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315871, "uuid": "2b6d1ca4-2569-4ac3-a094-9df6ff44d9e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315871, "uuid": "466a50c9-c914-4340-8171-8409589acb0e", "value": "qMSabx7WSGp4GN", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84277709-d232-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624239997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239997, "uuid": "33795a1b-a93f-4e22-9f74-a97656f75c60", "comment": "Malware payload (Gafgyt)", "value": "403133a4406bd1263718904cb9480028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239997, "uuid": "9f84c2f4-8160-4fb6-8ff8-77357f08897d", "comment": "Malware payload (Gafgyt)", "value": "4099b644b3299557c15d836c58d95e080033d48f76594a9b1efba2c16e771877", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239997, "uuid": "b7b32d38-3d5d-491d-80f4-9d4f3d1b1a1d", "comment": "Malware payload (Gafgyt)", "value": "81dc1e68b53730d77c8f33d10100ce5fc6c85c88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239997, "uuid": "42c5cdcb-3650-490e-8803-c4eefc14005d", "comment": "Malware payload (Gafgyt)", "value": "dad3ee26f9633454c563298b3662aab09ab68c9f85b9969fe23dad05d3a212ddd36d255b5bbbde8b2ac05c063a693d45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239997, "uuid": "1d6e3b92-75ca-402b-81f7-212b71383174", "value": "B703E13137DDB7D2D9501E33EB490C47437766C644DA909ABB280BC297E48802AEEE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239997, "uuid": "494e08da-8933-4c93-95ec-aab539a141f7", "value": "768:9ND3R4dUHOub4Kt5k+lIz/Hw3UHwuNtO/IoYksUmfgnk:9ND3SUu89rI9Ns/IoYkPm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239997, "uuid": "bbad83e0-5541-40a8-9da4-3f30d30d601f", "value": 39032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239997, "uuid": "dbaa8ce1-e41b-42c9-9df0-1cdb179aa745", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239997, "uuid": "e5e34863-21c1-4fdc-9ce3-a7e8f8d317cb", "value": "403133a4406bd1263718904cb9480028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d927ab7c-d2e2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315731, "uuid": "1ef8bcdc-1b1d-427c-9895-e15fe1be9dec", "comment": "Malware payload", "value": "6f6214041d1e8b14a06b10d54e060133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315731, "uuid": "164daf06-531a-45fc-a7ed-c5622f96ff1a", "comment": "Malware payload", "value": "40aa02a45bf04b6c7933179a4749624bf992ea0eabe6beb59de50bc0c5a25c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315731, "uuid": "6e4e118d-78b3-474d-aea5-8576d1778e2a", "comment": "Malware payload", "value": "f66119d1e29245dc866bbec5185a7eb657e318d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315731, "uuid": "3bf1258a-5654-4487-97b5-546c68dedb7f", "comment": "Malware payload", "value": "14824378d1dc67d34c894d2454100fa84bdb0f8fad222447491793662d93b411e2aae0abf0b73cc9220e1873e7df1484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315731, "uuid": "ab747685-e26f-4838-9143-69a254da51dc", "value": "2F64279DFFDA5F27D9A3063E102A8032827ECE560BA8FD175164BD4ACAF03F65761085", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315731, "uuid": "0917a453-3083-4009-b7f9-d5f38b9acfaf", "value": "57c147a9bbc95fb84767ff1e061348f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315731, "uuid": "86e7c16e-6878-4ec5-8cef-dc8a0e129d2a", "value": "6144:j4xlEgF0yrbegH9ZQIK3q6gK5WDxFHektdXXXXXXXXXXXXXXXXXXXXXXXXXXXXXR:G0Ubem9Ct6854tVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315731, "uuid": "cd782fac-96fe-4ef9-9506-80648034da9e", "value": 322216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315731, "uuid": "267e5a10-9229-4707-addd-4bf604083745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315731, "uuid": "39a7e9f1-d442-4903-a7ad-6ae11a7cb8e0", "value": "KrE7jvHDn5skPP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a249ca0b-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624258945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258945, "uuid": "9cef9a94-d5f2-4252-9611-83d9bd36dad8", "comment": "Malware payload (Loki)", "value": "38be7982e29d685720707f8cf2b744e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258945, "uuid": "b771de84-6ba3-4f9e-9045-ec71b094e022", "comment": "Malware payload (Loki)", "value": "4173cae36a80ef15ee084a9714c11589a6bc54bcc2b8fdb66e829b246ebf643f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258945, "uuid": "d993ad03-09eb-49c6-826d-8a05f55c8ae6", "comment": "Malware payload (Loki)", "value": "1e2a1a705c67a34039b88f989553da8e1d10c577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258945, "uuid": "109ea525-cd6c-4ba1-a76c-5a66de5a0c68", "comment": "Malware payload (Loki)", "value": "da2b7119ada1ac40ba996314e550ced2be3dcc16f416d19b42ebf0f1a47125a576df943762303a76302157d92899feea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258945, "uuid": "e6417322-9b27-424b-a149-8ae25aa755d8", "value": "08D4AE3039EE520DF577AF781AE476E2967EBE637B07D85C24D4234A8723842CB41939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258945, "uuid": "09d4422a-a034-4b6f-81e6-857a19ebf2a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258945, "uuid": "1a629e2e-eb07-4b65-bb5c-7a0fc372bef2", "value": "12288:TJ/zeSWFHmsJWzhnUd3t2249SYj2bDAtY7JDkD5XoCEkPXX16ExVeHhU:TcJHWUd09YYKbDUYgKkPn16Ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258945, "uuid": "475d67b5-7297-4952-a4a1-7d601909a8d0", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258945, "uuid": "ccb20114-abd2-42f1-8cba-f0999fcdb055", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258945, "uuid": "b73a7eb7-9317-4d93-b670-2e8174b43545", "value": "38be7982e29d685720707f8cf2b744e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2eaf2b-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624284352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284352, "uuid": "bca5ac9b-9268-4064-a032-8ec33b2089eb", "comment": "Malware payload (Loki)", "value": "e5bd885730c32b4ed953472acc56dd6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284352, "uuid": "0034b860-f5d6-4c96-8f08-83c67559c0a3", "comment": "Malware payload (Loki)", "value": "4191d513599205ace9e7d3e2cdf98b52b88b3ae1c1c01f2fc65ad1d992430137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284352, "uuid": "20eb86f7-caee-43a6-8d5b-099c63da84fb", "comment": "Malware payload (Loki)", "value": "7c8f771bf92a4661fe84c61a1416608ead231bcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284352, "uuid": "f35364bd-8fa4-4a04-88fe-f39082588dfb", "comment": "Malware payload (Loki)", "value": "e06dd8e44892e0d96f8604440405daaf2d9bb155fd294efccc05cc7e3cf871412dbdc2658261241741e3d12df5bbbb03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284352, "uuid": "a1e93587-2664-4562-97df-caf4859d39fb", "value": "E1E4D0303AD99615F27BEF755AE072919BFEB623A703C5493D9002C60723E41DEE253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284352, "uuid": "b2d8dcf8-a231-4019-8f55-ab0b0ff2de88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284352, "uuid": "2531bb48-0860-4055-ad08-f498161f3000", "value": "12288:QsgWFHmsk/sBzAtt2u75UVRP3aq3WYTl:1jHOWAt/en3aq3WYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284352, "uuid": "1b6ca976-b0c9-46e5-9682-fcca5817ffeb", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284352, "uuid": "6e5c1db9-9107-4161-b618-be7efc665efa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284352, "uuid": "abc5c52b-0a0f-4e70-ade8-23cd63f74f71", "value": "o8jhgzsjD1jQsHo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91bbf38-d2c3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624302363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302363, "uuid": "95964dec-5249-4c87-87a0-0b8a7ed2d238", "comment": "Malware payload (AgentTesla)", "value": "5beae2f6cea2c9f92ab4e2b34dfac0d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302363, "uuid": "8ea1e1e2-1931-441b-ad42-b939f674ebba", "comment": "Malware payload (AgentTesla)", "value": "4277fde72512aedcd199bfe2d51f005870a4c947dc4faa5c9806992b1af37c2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302363, "uuid": "fee79f3a-fb8b-4216-9e5a-4803289801c3", "comment": "Malware payload (AgentTesla)", "value": "bcc2fd8547e15bc77f77fc227b563012e16ba4b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302363, "uuid": "8bbf360b-f0c0-469b-8e6b-8914e6713d15", "comment": "Malware payload (AgentTesla)", "value": "e3252d46641e352db3903667041df5dd0042a345e11d1ecd7098f52b99f7b3719d8c7a2167e4ac0800e924c781a73cd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302363, "uuid": "2699c084-e3a0-4eb3-9424-9259c4329ee2", "value": "B405CF303AD99919F13BDF7649E0625057FABE27A712C10D3CA5338B1733B41ADA253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302363, "uuid": "00633049-b6cb-4ba4-8f06-a82f22686ece", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302363, "uuid": "8e4c545a-37bb-47d5-b917-f753c0095e48", "value": "12288:dsiWFHmscN7fKpOQk3cjl1r17txBV3bShEOSJZ/8s9nqAmbO/mAWYTlxEAmD:mZH+KUFcjlVFLB8hEOgZkCqrW3WYTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302363, "uuid": "ebe599fc-3db6-4316-9ee4-fbfd2d74aaec", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302363, "uuid": "fabd3647-6e9f-4261-ad46-92f4b4e5200f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302363, "uuid": "50d91548-d8de-40ec-8d8f-deb1d5f02a06", "value": "5beae2f6cea2c9f92ab4e2b34dfac0d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6367c2d4-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284180, "uuid": "805e1c47-850e-4897-b6b7-bc1acf9226c9", "comment": "Malware payload (Gafgyt)", "value": "896bf6251a3ded48eb289f41d92bfd7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284180, "uuid": "879ff628-0c3c-4b56-a778-c7477333e978", "comment": "Malware payload (Gafgyt)", "value": "440428a253a06e80e5a6055bf0cd07662ea9eadb303b193430c9e984d84ecfac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284180, "uuid": "18e05fd3-d996-45b7-b823-dbd2c72b6d45", "comment": "Malware payload (Gafgyt)", "value": "959e84feb4846fb0a0dcc0f9a3e051411e804c7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284180, "uuid": "870b65db-d191-4077-900c-4f6dbfa199bd", "comment": "Malware payload (Gafgyt)", "value": "f7a27192b7bc82b44bedc0198a44cde857707ac24e5e30d1b5b8d73c09d40739469812e06610e8d10cecb4604fbe6761", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284180, "uuid": "ad9f01b8-e6f4-4ac3-b5ce-93eec331b367", "value": "E2C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284180, "uuid": "468d52eb-78c4-47b4-a6c9-eedc17d615c5", "value": "3072:ekYPUfsgnsb0J2ag/Vf+kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0+kDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284180, "uuid": "7237e567-1473-4707-be96-d0e06403f134", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284180, "uuid": "3f14ce39-697b-4341-ac49-04bb6160d9ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284180, "uuid": "dffc8cda-c9a6-471a-a150-8797411c3c2b", "value": "896bf6251a3ded48eb289f41d92bfd7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b548a4-d24e-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624252215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252215, "uuid": "1af23eaa-c587-4f45-ae04-3d729e107d2f", "comment": "Malware payload (CryptBot)", "value": "a72f7115018d6d23bf8cfbaa34f1b418", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252215, "uuid": "b3ff74d7-0fe9-4d7a-92e5-4c755a1dbd3a", "comment": "Malware payload (CryptBot)", "value": "449654a262bba321b2942a1d3a8e2f651144d4cf02b26aaaa396b8216ee6a67c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252215, "uuid": "7cf5dd45-235e-4fc1-896f-97b5e1b84702", "comment": "Malware payload (CryptBot)", "value": "4d80ed32d6a7a8c84c5342a6ce162abab9b05f3a", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252215, "uuid": "e112983e-6596-4809-8e2d-0385d87b24ff", "comment": "Malware payload (CryptBot)", "value": "2da3bcc431cad77c468e9f4626b81d4d9569f630928a192768649de5da4b3605b21298f605e3ea6dec6ce68564fe2788", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252215, "uuid": "cf519d2b-613a-4060-82f1-d26810a390ec", "value": "4974AF10A760C035F5F712F86AB993B9A93D3AB0A734A0CF52D51AEE56346E0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252215, "uuid": "1b6aa044-caa1-4683-808d-087a843ce0b1", "value": "705a372c868b933d973ca642948b7012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252215, "uuid": "36183b7a-636a-4bce-90bd-51f9d6ee3865", "value": "6144:6v9+Zn/M4ensYtUNL9fhkZWC1yNK/u/xyqlbWEHUFUQLbTN:k+Z/M4ensYtUNLGWC1NuUq9WSqhTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624252215, "uuid": "a64f41c4-bab3-459d-989a-27b0796c4197", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624252215, "uuid": "ffdff521-4471-4f6f-97b3-360d87b2fba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252215, "uuid": "e50b23ee-26e1-4ce8-be3f-3087e30b94ee", "value": "a72f7115018d6d23bf8cfbaa34f1b418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87cc5dd-d24a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624250473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624250473, "uuid": "9ec3efc9-5cb4-4354-afb4-e41696fc14b9", "comment": "Malware payload (RedLineStealer)", "value": "a19740453493d1c114a1734a08fb4e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624250473, "uuid": "df23b769-56ee-4a15-a235-301201190282", "comment": "Malware payload (RedLineStealer)", "value": "44f77ffc31be3c501a83f5beb01a7deb434ac41b4ffadd96a2084cb6eaeda486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624250473, "uuid": "1596b2bd-ef84-4d1e-844e-4b68c75cdf12", "comment": "Malware payload (RedLineStealer)", "value": "3429c4331e3b97f7f9b2e52a2744a399bd3e4d90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624250473, "uuid": "a8755259-43fe-4db5-873a-f0e7b3de49ba", "comment": "Malware payload (RedLineStealer)", "value": "d1c492e338465de785e981232de6f54aa687f03805b833ed591a65e62833c1f94307b9616825bdb710a93ea2d640bc4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624250473, "uuid": "6e2cb761-45a9-4b13-b15e-10dbce1b5625", "value": "CC34E102BF6269AFFEE81972A46206F11B716CB648D2D70A35B6720F0DFB754091371B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624250473, "uuid": "3bd56e55-f78f-4cd4-94c3-0f941ce4d776", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624250473, "uuid": "7ba2f384-b32d-4751-9229-81b4eae4511e", "value": "3072:tKIgrMQ2vx3zBuFsidzW5b6+JSZIqGgeeaHbl6iyigO9y/pEAWCuDDR:tsrMJ53zBuF/BQ651CPbgWy/pzYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624250473, "uuid": "db158b15-46c3-4831-a71e-0a1c92f42da2", "value": 250112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624250473, "uuid": "da461d11-3a1b-4cfc-a049-67e39fcf897f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624250473, "uuid": "e7a96fe4-8ce8-4c5d-a463-31e98a524284", "value": "a19740453493d1c114a1734a08fb4e8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b029815f-d2e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624316521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624316521, "uuid": "b48b40a0-7460-4e39-9910-bf5ab0c41edc", "comment": "Malware payload", "value": "8d0ca9522f816adf80a2a04384e13c28", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624316521, "uuid": "e6d83944-da37-43f8-bec6-13afaa9cb451", "comment": "Malware payload", "value": "466bdf0a15a92a8951e9288900bddc865bf27ba95b9fdc8fa3654e41d267b595", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624316521, "uuid": "932c61ce-888b-4733-a579-4063582cbdc7", "comment": "Malware payload", "value": "34b3ecc56a41c8767a367136be858f3b0f8d2693", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624316521, "uuid": "2bccaf44-e0c8-43af-8c8a-b509ad96bf7e", "comment": "Malware payload", "value": "d738d07831541f0abc1c2b1aaede86789bf5bccd69bd48ed5dbf4ab660e3232570c97c781a38c4d47123bbc9b9770563", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624316521, "uuid": "b12fd10e-b859-4dc3-95b9-dda136d4880e", "value": "B6A3189ABC919A5545D413BBBE7E818E330723B4D2DF7113DD041F18B6CA94F0E7AA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624316521, "uuid": "ad9fdd7a-378b-48ba-a5a7-d02983b72110", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiBZ:T2s/gAWuboqsJ9xcJxspJBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624316521, "uuid": "23769588-5302-4e62-ae84-110958ba6aad", "value": 99360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624316521, "uuid": "d1cd3ec8-b190-47f8-be2a-f1e141c180bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624316521, "uuid": "89469dbb-bec6-4a64-bb60-b22930c234b3", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f577d009-d2a7-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624290438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290438, "uuid": "7978c709-c0aa-4ceb-806e-d31e6f8aede7", "comment": "Malware payload (RemcosRAT)", "value": "cd4d0493ef29e549f1892184349a5ab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290438, "uuid": "1258f14f-b6da-4f24-8496-97830a03b823", "comment": "Malware payload (RemcosRAT)", "value": "467391d49e0acf8a6493cb1f1e395ab59d3f77c0f6eeae97dd6098ae450ca046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290438, "uuid": "f7380462-b94e-4c42-800b-6e43feca7cc8", "comment": "Malware payload (RemcosRAT)", "value": "0c3ca5adcba9cd6e72c0b021086136544403d1ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290438, "uuid": "e3ddf3c8-f9d0-4360-9dfd-5156d3cad4de", "comment": "Malware payload (RemcosRAT)", "value": "e289fa6855b9fe92271419bb29254debf077dbf436272d83d20cc178f15f6f86991a0979c1fa2aa9c968024e89b82abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290438, "uuid": "0db47384-4546-4add-a0f9-165a8f375e33", "value": "AE55D0220ECF836DE2754FB51770BC4782B6ADAA3605A2253DC031AEC9375DACDEE511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290438, "uuid": "09c95671-585e-4c09-bce9-b0b017dbd446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290438, "uuid": "fafad4c9-edec-461d-9c77-cdc335b93fac", "value": "24576:vApHaipg0WNd8lDUhcsezi6Bm+eX09giv/WXzgSkXT:SHI0sdQWcbzi6/mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624290438, "uuid": "952f6df4-3299-4fa9-b4f9-77a52f32937f", "value": 1291776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624290438, "uuid": "33b5b236-a274-44f1-9043-7518ca88c274", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290438, "uuid": "f33f63a2-344b-4b4d-b646-586f47c0b32d", "value": "swift copy_pdf______________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c677d06-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303522, "uuid": "ca14864a-085c-4a6a-8e96-ca44343d7aa0", "comment": "Malware payload", "value": "35d8c5ca4ad2af5f2a360cad0003bd42", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303522, "uuid": "27a1ec74-d04a-41d3-baf6-8a31a30992e4", "comment": "Malware payload", "value": "471578f00b2f4e3aefc0dc3c625569210c67a08e6ac203de96918c31aa802bb5", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303522, "uuid": "c5392736-5b34-4920-9005-e800fd2f828c", "comment": "Malware payload", "value": "02ae1065409d7f897a90155f85881f340a847ea1", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303522, "uuid": "71e1b86b-5b31-468d-b62c-e0b790952da9", "comment": "Malware payload", "value": "e709c833ed18ece53457fa3d573368305292b4af1ced8c57bd955f421d7c075b63fb4ec7a78ee992dd931e77cdd6c133", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303522, "uuid": "46f27a6b-d9ad-44f3-8dce-2b7d2e2a1bd7", "value": "1B51C8C4EC61CEEC067B6C4E6D3AA2656C44453051F0D83FC8C6E9C359E0BBDDA4B561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303522, "uuid": "7102cb8a-8b05-4583-b443-a9e0fc7ac8ca", "value": "48:ZZty9cDUk6Bw13rpdbz/wLgXaad1CTt0FaxiJV7KRAVu9AmooWaAcDxD7MSRcOcT:v49cCQ3rpd0gXaa/aP2KReQwPcD5lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303522, "uuid": "c0e44bd0-92c2-4be7-aaf8-a61d60f32ba7", "value": 2959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303522, "uuid": "96a8012d-c90f-4792-802b-15f698829b54", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303522, "uuid": "7d23c596-b6fa-4b85-a2b7-d0fae1cdfa44", "value": "procedureI.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9784a0c9-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624258927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258927, "uuid": "30bbae9b-75c2-449b-ba04-c586965de03d", "comment": "Malware payload (NanoCore)", "value": "a70791323ddba2afdde36530d5b2608e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258927, "uuid": "1218b8fa-0788-4711-ba8e-615cf942efb8", "comment": "Malware payload (NanoCore)", "value": "4737ea5151d02ccd6fdf58f879792c4e0b8a682005bdea63f28c373156d407cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258927, "uuid": "53aade6a-94c1-4b98-bbb2-c60135ec1c94", "comment": "Malware payload (NanoCore)", "value": "bb55049cb1d427514beb00a08005fbb569329dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258927, "uuid": "13cf61ce-4532-4351-a1f0-ece2e800358e", "comment": "Malware payload (NanoCore)", "value": "e5a4fcb09511b393667fe58f598107f66567f4121580bfb054da2749808727b8e8e02b96882ee6b4bdb5e79a42c5339d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258927, "uuid": "ca5d47c5-6afe-4d5b-9420-6e906e1fc1ae", "value": "3A13D0409DECA43BD6B942BC65A7974587A396334412DB9FF84CA0277F633A209073A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258927, "uuid": "7816f5ae-2a8a-4074-8c4d-be80af719e8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258927, "uuid": "83a09550-78d9-4c3f-92c4-adbb1fa9ca97", "value": "768:m4pgajg/btxRJze1jhwTZV/k5tfzPnGfMkbkqRBt1jCYcIP:VgtnVe1jhwVV/k7GffHlXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258927, "uuid": "db7fb64d-7a7b-4231-85ca-4bc5991cf2c0", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258927, "uuid": "4e15434e-76fe-41de-8607-565209209e77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258927, "uuid": "db13882a-2c51-42a1-9014-5fd56f8a423e", "value": "a70791323ddba2afdde36530d5b2608e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc8a21d-d232-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624239989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239989, "uuid": "b9dd5bfc-755e-4479-a4f7-d4dc674dad12", "comment": "Malware payload (Mirai)", "value": "dc58ef8e0fcf6b79274a549d62a021f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239989, "uuid": "e4edb504-2626-4952-a377-a8de9a390532", "comment": "Malware payload (Mirai)", "value": "47611579a0f777f346c3abe8bdb916413671479d1a867b4342a361ec5c33583e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239989, "uuid": "474d0317-e57b-4fe9-9894-2130f48413c8", "comment": "Malware payload (Mirai)", "value": "e0c7972b991cbe0e1aab58b08e2af883d51ffd62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239989, "uuid": "795a1200-de3b-4570-9147-697b5b446e39", "comment": "Malware payload (Mirai)", "value": "164091218bdc83dbaf005e28ba5b4929c3187ae29bb928bf3e4247c2efe5eb480442d0f4fd5c31873ec2ca98e4e5efe7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239989, "uuid": "8f1a7d5f-01b7-423c-b42f-31b9bd7d6fab", "value": "4D04F72ABB61CEB7C80ECE3305EA4601118CE55612D96F6FB6B4C52CE70BD4E49E3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239989, "uuid": "f50e4c18-b90b-438a-acc9-47896f21e609", "value": "3072:1IP+esysPAFpq3DBVtsKGSg9PLDFdb99SRpnAmGgDDq4B11IuaYB:mP+esKoDBVCKGv9DhupnUgDDq4B11IuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239989, "uuid": "23ee8aef-9664-4616-8854-7bc0b1391e36", "value": 187104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239989, "uuid": "a45f0e17-846c-4400-b72a-2c4cf4d0edaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239989, "uuid": "d8d9648e-19df-4bce-a593-8f5151423ee0", "value": "dc58ef8e0fcf6b79274a549d62a021f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33cd632-d231-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624239700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239700, "uuid": "7d7e8979-8695-4145-8137-7ebf6392dbae", "comment": "Malware payload (Mirai)", "value": "21d53825c777ea62981b1339faef2466", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239700, "uuid": "b062ccc4-d40b-4bb3-b0fc-c3578898fa79", "comment": "Malware payload (Mirai)", "value": "47b067761fd0c6e58cdbe9695a38ee194bf7b4f314cd639b8dd1a3401a2bd4e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239700, "uuid": "7b92ad56-b0f4-4b86-a3c7-8badfd844183", "comment": "Malware payload (Mirai)", "value": "64b3992ac5bacfccba49c011e01d228ed6bb3165", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239700, "uuid": "92765cc1-b45d-4040-b28f-35f23edc0f3f", "comment": "Malware payload (Mirai)", "value": "ad73e75110f02439540d6f74f95bc43fe8a0ee3c2b1df95f5b0e3e7b313089a78be169fd1b57fe343aeff20ff2ca3b0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239700, "uuid": "a39d4549-6b2d-432f-8266-90af6436aeca", "value": "C0931943A8A19FB7C146AEB566774E640753BC512F4B1B89712CBAF4033B5CDB80EB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239700, "uuid": "a79825e3-0a57-4c2e-8b58-6af59698d844", "value": "1536:UTvqUqYOUSYXcKdQX6iAJmvQU2v0CdojEEmK4Npbsizfn61NH:UTCxYOUFXDdeAJmU0Bj5mHNpbscfn61h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239700, "uuid": "904fb43e-3caf-4003-a656-59b019e19c40", "value": 91601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239700, "uuid": "f9b69e58-e82a-495b-8932-40c6a2bba842", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239700, "uuid": "a246b3d8-075f-4cb0-ad53-3c36c8f4eed1", "value": "21d53825c777ea62981b1339faef2466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfd69bd-d25a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624257057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257057, "uuid": "b224c5cd-f9a3-4785-8d50-338d6839522d", "comment": "Malware payload (AgentTesla)", "value": "a7c6edc0ba6c23d65a9e97bfa3d3726b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257057, "uuid": "0aede914-2d1d-49cd-bdee-f6f6737dcd0e", "comment": "Malware payload (AgentTesla)", "value": "4aa853bb55b68d05d40aa8215fb1ca3127ee330b1e7a4796efe3d6a89ed22d27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257057, "uuid": "f5ed9af0-b061-4b69-8d0d-fa8815d38041", "comment": "Malware payload (AgentTesla)", "value": "af8f3ecf78af2744e0aa7be3dd8101d7ddacf6ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257057, "uuid": "aa51a04d-7dff-4ce9-80cc-a93bacf18f72", "comment": "Malware payload (AgentTesla)", "value": "566e08fe1212706e6fd7bc2a957740daa354a0626480932bc2eb25ab6df4b2b57c5fefe9c577e1c8aa9c7a78db26737b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257057, "uuid": "710f0a48-18e1-4293-a055-7ea27cab2d90", "value": "7705AEF875047DD6267F536BCA96ADDD13B626239A8BA4CC8068BBC30573375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257057, "uuid": "0e613edd-2941-41ef-a761-99f64292edf5", "value": "24576:IFvbsk8GSOqduz/wM/4sNOqsG8zwXnjNaUwLoaR:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257057, "uuid": "9bd931c2-3e6e-4e8c-a148-b4f717a5027d", "value": 824476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257057, "uuid": "e9888628-6901-4117-898d-b1c90cd5440b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257057, "uuid": "420d2982-b222-47b1-ae27-9f36511927a7", "value": "swiftcopy-scan86.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198fcfad-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624259145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259145, "uuid": "405573c9-3740-4f49-8d51-8bc031922640", "comment": "Malware payload (RedLineStealer)", "value": "77df4fac333e506ac55386e7d96ffd57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259145, "uuid": "4c5d7855-b41a-4989-add3-ad6c8ffb130c", "comment": "Malware payload (RedLineStealer)", "value": "4cce764abc9c530276a82397c4200fe0ecb2c8137ef1d1b91ad38beccc37b02b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259145, "uuid": "fcb40624-c8b7-440e-825e-103fb1be3c86", "comment": "Malware payload (RedLineStealer)", "value": "2e679dc5259a6803e5d499c6b5003d160cda5752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259145, "uuid": "da4ecc6e-4327-41ca-88f8-f8e823ccbc8e", "comment": "Malware payload (RedLineStealer)", "value": "fb2e088784ce8d4611721e5aa496c9ea2a440a7b642cd2beb48f6773823330e0fc812c0fbb72f32a3beb60251fc2d6c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259145, "uuid": "ff5388b4-356c-4987-a951-335840658bb1", "value": "EC94AF10FA90C035F5F766F81A7593B8A53D7AA1A72490CF52E52AEE1A347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259145, "uuid": "0e6e793f-1c0e-436a-b085-9afeb3568c63", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259145, "uuid": "62bd4b35-f62f-4faa-b05b-23843a6a78b3", "value": "12288:KFylHkxguySRp7whd9pgrogIsIBsgN+l:HNkxgu4v9pgUX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259145, "uuid": "fa556688-28a5-49e3-ad36-a8cb7c75ae5e", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259145, "uuid": "9a2a0268-e6c4-4462-98c9-7899ed179146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259145, "uuid": "1d21a022-d44f-468b-b330-a9a2d7612b39", "value": "77df4fac333e506ac55386e7d96ffd57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2cb50d-d25c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624257940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257940, "uuid": "eca825df-1042-4a0c-9cf0-017745169b44", "comment": "Malware payload (RedLineStealer)", "value": "80c1041604f141a9a020b53b7fc3c579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257940, "uuid": "b45cdcb7-3f10-4ead-82c3-b8e1bb018f78", "comment": "Malware payload (RedLineStealer)", "value": "4daa63efa5fede8eacf4f4bbf2543e426cebffa66a351c885ba159d36f4a82e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257940, "uuid": "61257080-4fbc-4669-ba60-cf78c15099d9", "comment": "Malware payload (RedLineStealer)", "value": "6e6bdf04b0e50011823b790a0e219d9f895c216a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257940, "uuid": "645da1ed-6c65-4aae-b4e2-97f79bf7eebe", "comment": "Malware payload (RedLineStealer)", "value": "9e8e8015d763664fdf0e193bf18c0e0999649685e59aa7dbfd620ed713332778c32674bfe74c86231449e4d087261e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257940, "uuid": "79793f4f-1a51-443a-9647-1b4b5e996252", "value": "B984AF11F6A0C035F2F766F45A7A93ADA53D7AA16B2050CF12D52AEE1A347E0EC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257940, "uuid": "0cda1dcc-7208-4fdc-a0a8-163a621c731c", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257940, "uuid": "ec3963b6-4723-406c-ae96-340d1c54375f", "value": "6144:ngJ2jItw+rO2m4t2OGhK8bj8ayg8rImOoLbFVVzmgzNAPoipsQAKriC:U2jww+rOB4tyK8bj8Rg8ryotvagBltl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257940, "uuid": "5aa5d2ef-032e-4fde-86ae-bb42b601c6b0", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257940, "uuid": "cc2092bc-153b-4f55-8158-b741c705fe1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257940, "uuid": "85c682e5-6bcf-4f1d-908e-5b76e1c91e74", "value": "80c1041604f141a9a020b53b7fc3c579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d1df11-d2a9-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624291024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291024, "uuid": "6c9ecfb5-9e08-42f3-b533-f3eff586b52e", "comment": "Malware payload (RedLineStealer)", "value": "208923115a4f639d4069ffc5499d250a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291024, "uuid": "defb9ec0-1763-4024-befc-a6f4de756ac9", "comment": "Malware payload (RedLineStealer)", "value": "4db2cf21ed080aa6d30503a18bccf3180ea748ae648c0b1c1e776de9b04c7156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291024, "uuid": "0be4b8cd-d2a8-4608-89b0-5100a31092c5", "comment": "Malware payload (RedLineStealer)", "value": "b57a90bf5383cd2cb3c9b4ce673f185decbe6c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291024, "uuid": "a869adea-51bb-4430-adcd-5d35535753c7", "comment": "Malware payload (RedLineStealer)", "value": "3555c37e2a88a12f534b39a04e5190f1bd023f13dd2a304a1bcb73a9b33fd82d950d58dc5c5f88b47e196c8f65c1ee73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291024, "uuid": "19a5497b-c2c7-4931-84dc-b5cb4cff90e4", "value": "742617F13A0EBE9FC3465CB5F4029543C1281FE74658E550FA5A7C7887B2C6621CABAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291024, "uuid": "96730c4a-276c-4c83-aeb7-1658da78d8a0", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291024, "uuid": "e0829369-aaf8-4be4-8f5a-56cc463a636b", "value": "98304:aW0JBDJgchLrW8yHzYFiSecMXmvnaHwFTyCr8b:GBDJgOW84zYFpeccmvnCwACr8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624291024, "uuid": "926b78ab-a24f-4413-b545-038fcac5d916", "value": 4524032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624291024, "uuid": "34866e13-b30f-49a0-91e7-d92dd2e2f5e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291024, "uuid": "d1950a88-99cc-40f1-aecd-11b2f50f30b7", "value": "Umbrella.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf541432-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315285, "uuid": "149527f8-5e3b-49af-b951-58704e27addf", "comment": "Malware payload", "value": "8cc9e8d4a7cd9f02a1c83804a0e09625", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315285, "uuid": "1c84422c-bd6d-4aac-b23a-7acad68452d3", "comment": "Malware payload", "value": "4dd3df961aed15425e05208c0c78ea80a1633be0fd14a913ceddf36cae0d9d15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315285, "uuid": "6d9ff5ae-9ba1-4447-8f8d-90b5454a5d6f", "comment": "Malware payload", "value": "b80c73f891d63065799c9266e397b6caebfd0293", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315285, "uuid": "09423f2c-ce31-43f6-875d-21f15e045efe", "comment": "Malware payload", "value": "0e104e310453052bb35b2d051d830d29cc32f3373af01778ecc74800305c8d5e0f6e29a10717335913acafadfac1777e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315285, "uuid": "74135c80-38ba-4608-a03b-bc15c9b3e97b", "value": "01033A91D78F61EBD80B08B0115B773F15304B0AC74CDEEAEF449B62E693B12A43E945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315285, "uuid": "d114d422-a24c-4e24-9fe8-1b12a6ce5378", "value": "768:oZLyCEa/LOKcWoq1YBFNy8qKKeKAKqj1PXGc:qLyC5rcyBVtqjJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315285, "uuid": "0eef8334-9282-44df-a0cf-1e8ac29b0d2e", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315285, "uuid": "6750ad25-2963-4d25-b043-8f5271cb1a2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315285, "uuid": "6045ff84-dcfd-4381-afb3-5abf3f2356f3", "value": "c3UdjYJ5WpLq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a926eb-d2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624288291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288291, "uuid": "e19197ef-c895-4123-87ef-be4a877a7aea", "comment": "Malware payload (Loki)", "value": "bd82e968846ab3d7b35b0f49a2522494", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288291, "uuid": "e2e97978-0444-420e-a194-fb4601cdf08e", "comment": "Malware payload (Loki)", "value": "4eb265e9a2a0b119bb5d4da0eb39c17d9b2a25aab1f14abd4b41f80087ac1556", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288291, "uuid": "368ea373-ddc2-4948-8bf8-df1913f1dc53", "comment": "Malware payload (Loki)", "value": "c6304f99e1f84261889fd8f75fb8b25da49cbf05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288291, "uuid": "b31a44c3-8552-4b5e-9963-99cf315dabfd", "comment": "Malware payload (Loki)", "value": "cafd2e219a99b54c383467f297b94bd02b89cc1103d153e2b8f099135a5a518ef1af3df31f946a45090da5466ee587a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288291, "uuid": "b57476c0-62c6-4569-b38b-8b36c204f5fd", "value": "DF74BEA64E55E377D93A5A72D1F3F33D92FC82E4FD980A11926BF7B8B22020D7216414", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288291, "uuid": "5853a8ad-699d-4e0e-b098-e6fb33ab526f", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288291, "uuid": "fc2850b6-4463-4028-95f0-b0fb2be2f3b9", "value": "6144:pBlL/nQYWaFxBiwOViJCc7EfCuSpU43UMFYgGA8KYjp/4IX:P1Q7cxBi6EtfCuSpx3UMCgGARYlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624288291, "uuid": "7c83d8a2-8c9e-4e8d-a22f-e1e0b565f990", "value": 342258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624288291, "uuid": "85f5d61d-36d5-4e04-bda4-496f74356b55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288291, "uuid": "766e2a66-d714-4a80-9390-f3767c9f7bb1", "value": "bd82e968846ab3d7b35b0f49a2522494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c63f0b-d232-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624240004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240004, "uuid": "45f75ce9-242d-40b4-8f6e-b9ce16bf611f", "comment": "Malware payload (Gafgyt)", "value": "8d9b829a96790995fe3c7ff331eb9821", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240004, "uuid": "2942e3f0-470a-48ad-b022-3dbf5d437961", "comment": "Malware payload (Gafgyt)", "value": "4ec5b45ae52c28fb174213ae56803152665dc63f144e8f5d9abace5e66242dc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240004, "uuid": "87fad5fc-cde1-478e-9a6c-074e1be59e3e", "comment": "Malware payload (Gafgyt)", "value": "d5fee3cba776d643261dc5dca5c89797a3b0b4c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240004, "uuid": "8912b8ca-4efb-461e-b688-d0acf6c9a11b", "comment": "Malware payload (Gafgyt)", "value": "3f8abdc74c496506237bf6603829d271b23b56f62085acd2351a74e7e94317b6c1b346596d1317abc2524f895cb16472", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240004, "uuid": "29f2c9c4-f998-4b67-9474-61aafe7c5d87", "value": "0213F17FFCCA3B8DCECF9F7B856948E22E95B0413096874C73A058568E5240A736E462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240004, "uuid": "caf5806d-cb42-4c1a-9457-a11ea0cc3cce", "value": "768:u8SFrz87d8cyLSYhCcWYB/k5Y85ha+Z4rjYWRf95CP73F:u1FEZKWYhCmB/k5R5k+GrX95+73F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624240004, "uuid": "a13d3383-b193-4732-af77-5db4c79bc0d0", "value": 42420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624240004, "uuid": "8c4a417e-e553-43d7-95cf-b1c660210591", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240004, "uuid": "e85765d3-9913-40a6-be6d-f49855f68e08", "value": "8d9b829a96790995fe3c7ff331eb9821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95777466-d252-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624253770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253770, "uuid": "94804a52-0bd7-4ab0-9d16-db480f5c3de2", "comment": "Malware payload (AsyncRAT)", "value": "a6e4745f77d736bc7b275a3c427c085c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253770, "uuid": "828a2227-8430-44d2-84aa-da768bbe23f4", "comment": "Malware payload (AsyncRAT)", "value": "4ed4aa642d67b79463edea71fa8781461cd6a63a4a01d20c497328801381a09a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253770, "uuid": "c1182447-f221-4adf-a6f7-159fb3617c97", "comment": "Malware payload (AsyncRAT)", "value": "0368343f5b768f81531fa402567434c89cccf814", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253770, "uuid": "b6551b8c-3915-4051-be75-da126c8a5d8e", "comment": "Malware payload (AsyncRAT)", "value": "f5e9c1da47a9a510a5590f74e83f51d8e8d4989aab4d1c0682d305981baf459644c453bfcfb0ee69b9db9d8077f120f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253770, "uuid": "8c6c6567-f142-40e6-90da-15559d1b1484", "value": "6834F109D3CB9CD8F676D179D8B2D7113BF0F8849161CB5A786CD0923BA33923C6196A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253770, "uuid": "ca83ebe7-a2e5-45f0-9858-2143308d0ca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253770, "uuid": "68f21139-deec-4d38-b70f-98ebd9c73b51", "value": "6144:rC3JtenEPUDGYD1ttSFISh/vj8DEeTBYL:r8IE3AtyljmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624253770, "uuid": "394ef738-e384-4e08-bfcd-005dd1d7fd5c", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624253770, "uuid": "bd832057-ac5a-47c1-bed1-a62b3c302263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253770, "uuid": "28880746-e61c-49c4-9dcd-c6bbb3eaf528", "value": "a6e4745f77d736bc7b275a3c427c085c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae21e79-d232-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624239981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239981, "uuid": "08eaaf27-41cc-435d-871b-2b14e4416f9b", "comment": "Malware payload (Mirai)", "value": "bba70f5fece2b16750b5e13ad78ddf74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239981, "uuid": "fb532dc1-741a-498b-b7cc-b94b1ee1fb54", "comment": "Malware payload (Mirai)", "value": "4edd60533dad9e67b201b3eee0b66e96a92b41281f450713d4e235d83719f950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239981, "uuid": "372d6263-ae9d-46d3-804e-4f1bd7523a47", "comment": "Malware payload (Mirai)", "value": "dfabbef1aa52ced50605f08def7e6c3752035045", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239981, "uuid": "a9ad257a-6d73-4ea5-a0a9-8eeeb868a89b", "comment": "Malware payload (Mirai)", "value": "2f6b4a0060f6d14e636b9705b3d709d288009cbf7e0422e27a43a4d5f07838b3beb54e60662f603e580cf22f29f731cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239981, "uuid": "01558345-1b09-41bb-b8c8-ed25784e77ef", "value": "6403E0209DCB1F9CCCDAB8F18C96DBD357DCF92D1CAACEE6B094AB509142B2651909C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239981, "uuid": "c5b527b9-f250-4ef8-9d12-a78d07596930", "value": "768:ghECa/Zo6v2ZtovD94elhY9SDtNBlIEe4uVcqgw02NWXoQHQx:CEzZo6vstomePaCWEe4u+qgw06WXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239981, "uuid": "c6c63050-236a-4eea-98d5-053b080c7132", "value": 38316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239981, "uuid": "9748313b-1808-4e48-8fb2-52bbf75c7143", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239981, "uuid": "2cd150c4-cf9f-4b7e-a284-114d8e5e556c", "value": "bba70f5fece2b16750b5e13ad78ddf74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab33b440-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624303628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303628, "uuid": "fc138c7e-1de6-4b05-9de1-9c343c2611c9", "comment": "Malware payload (Gozi)", "value": "03c6ed8f081230a4ea159699557508e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303628, "uuid": "e130d0e0-73b9-4157-93b5-821231d9a7c0", "comment": "Malware payload (Gozi)", "value": "4f1837fb94066946162aad84d00789e80595f2953547e5ad16ee62e10a96988c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303628, "uuid": "68abbc0c-f65e-4d2d-b03b-f2dbe2ebb663", "comment": "Malware payload (Gozi)", "value": "6810a054f7df966f41b57dabf7cee9b85e4bb4a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303628, "uuid": "70e91063-e4f7-4c1c-8df9-bee688e5875c", "comment": "Malware payload (Gozi)", "value": "0df75026a78106c8f1d5d6011983726467a89119590f0dae165187e8ce427784ac19c9be4380d46343e8a6763b95b660", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303628, "uuid": "0d2ea6e7-56ee-418c-8d42-b0ebf2725f2f", "value": "3E647C017A889030D1F352760F24EB81476DB9665B718ADF3BEC2D8E1F7A4D29336762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303628, "uuid": "9823756b-34ef-47fc-915d-987e80cb80f0", "value": "8199c7f6de79daeb94a04a3f31dfd4d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303628, "uuid": "4f55efbe-b03c-424f-94d1-8513763edbc3", "value": "6144:Uwfyz7+Vg3teuh/2Yg9AXCeJBhqNgam/HGuF1Fanm:Uw+7Agdeud2Yg9AXvBhq2am/N1FUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303628, "uuid": "d93065f5-515e-4f78-bbc0-b79527d88618", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303628, "uuid": "6158afc1-4129-491d-a9b3-4eeb95e86f22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303628, "uuid": "a14fa812-50a9-4ea2-b2f7-9d2dc63f8a0f", "value": "procedureI.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3feb686c-d245-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624248043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624248043, "uuid": "ae708570-b8a8-4359-ae73-1e9f7092a44f", "comment": "Malware payload (RedLineStealer)", "value": "1f140287485929ef4d607b86545cc4a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624248043, "uuid": "46d53ff6-f713-446b-9bff-5ef7c32fbf62", "comment": "Malware payload (RedLineStealer)", "value": "4ff14095574ea8290777ef3c2cf0b3871a0a7a6b9a5f97cc0123e73faaa1104e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624248043, "uuid": "3cb40232-6c48-4235-892e-d9e0c9874aa7", "comment": "Malware payload (RedLineStealer)", "value": "6bf2372e9715be28c6060799ba33d2705273bef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624248043, "uuid": "8e5b9628-7600-4bbb-aa09-82b1165112a1", "comment": "Malware payload (RedLineStealer)", "value": "100b41685ea831835cb31f8fbf4f34b20da0daafca6b722dcf9d2190194313f2d9458aa9e347cddf57be54873736c57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624248043, "uuid": "154b16d7-e8ba-475a-a079-bafb6e302f50", "value": "5C94AE10EAE0C035F5F762F85AB593B8A53E7AB1672490CB52E516EE1A347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624248043, "uuid": "9583c6b3-65b2-40f4-8e98-0a3f9d2ebac4", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624248043, "uuid": "bfa872a8-7259-4b7c-92db-152b5d17e241", "value": "6144:AdcEUIilHkRguDNSTEppweyN25/ov4kV3pDIV2LTW8HIKHFqKriT:EU1lHkRgu5SAp735QVpHFHn4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624248043, "uuid": "ae95f815-a4f4-4be8-91f4-798c4e2657bf", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624248043, "uuid": "4e6e6db7-60a2-4505-bcb1-81558e4faa00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624248043, "uuid": "05f5da04-0cb7-4e9e-876f-d3160d0462c5", "value": "1f140287485929ef4d607b86545cc4a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617d3267-d2ec-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319825, "uuid": "85054240-61b9-45e8-8d7a-85049796a70d", "comment": "Malware payload (Mirai)", "value": "21779de23fa27222d01324ffaf12e2cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319825, "uuid": "95e66697-4817-4698-b324-215a947ae6a7", "comment": "Malware payload (Mirai)", "value": "5165b9cdaefaeda905d1000e256e9e5515f61cf71a2e48e40142a2d9c7ad6b2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319825, "uuid": "3c0e480e-294c-47dc-9e66-243940ed32ea", "comment": "Malware payload (Mirai)", "value": "4f785b373bf4977601f8d8fa4efde1560349d70c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319825, "uuid": "d41dafca-f13f-4d42-8191-3e058dd4f70e", "comment": "Malware payload (Mirai)", "value": "fd2ad73543dbfbe5d065b5ea7eccb450c8755c9ca6526aed7b108cb9f9e4fed4543ba6dab61e9bec1795c647d5ffea5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319825, "uuid": "7a6a18ac-cd85-4ebb-a7ce-2dce11f36aa3", "value": "BBC2D0306ED879B0C7B6E5B9DB886111F3028767A1EA631300115AA4849B64F7BFCFD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319825, "uuid": "017d3339-db57-4852-bc95-17c8ad0aa638", "value": "768:LL7GgFP0x2J8ER4AIQYh8HM3Oy81eBP4s3Uoz9G7:z+x2Jz4YHM+y81e3zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319825, "uuid": "86e9497d-fdcb-488d-8873-e24dd9bd9a13", "value": 28224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319825, "uuid": "fcf3b2da-6c72-44a1-b5d5-f0d3d5161522", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319825, "uuid": "852cf79c-6680-41e8-bd4f-f6ffa6ee71af", "value": "21779de23fa27222d01324ffaf12e2cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad1b91b-d23c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624244142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244142, "uuid": "5f8b8448-3daa-4c05-af51-96ec5343e301", "comment": "Malware payload", "value": "34b2d327ebe6246d844b7a4b8640d4d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244142, "uuid": "75deb10e-a9ca-41b0-9286-24648e1a4528", "comment": "Malware payload", "value": "519ba7ae267491633e2a01e55735586ba94829871e5c4ec2fe0a5c8fafe004b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244142, "uuid": "1303503e-f4dd-487e-843f-98cc63170c57", "comment": "Malware payload", "value": "908d7fe2ce5be41f4096641dcc7ac0023edb4c94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244142, "uuid": "1fa2c02d-ddf9-4c43-bac2-a8a825f33136", "comment": "Malware payload", "value": "63d7144ac71fa2329d2cb328aec6194fe9a665072957f0e3a45c26d72147ed424b84505f5417b330444817ba04cc1584", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244142, "uuid": "fce717bc-9508-44a8-a0fe-8c537e5c0321", "value": "D5E2D65665917158E6E308B02D52F9343B2CB7B068C4E20EE461864CCF826FB74EDEDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244142, "uuid": "24aa0d96-41d3-47cd-ac11-a7a9a17daac7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244142, "uuid": "91c79e18-795c-4e43-a9aa-b0c8ccaa23ad", "value": "768:JsivWH2B6fG7JJvNyWnQrbY5tfkwKw+wph:JxzBiGQBXY5tfkwKw+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624244142, "uuid": "99a14f8d-b553-4198-acbc-8761c61d042e", "value": 31544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624244142, "uuid": "943ddb0f-f631-45df-9212-021f9cc6bc37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244142, "uuid": "68f8c604-dcb1-4bbd-8005-1a77ccd7172f", "value": "34b2d327ebe6246d844b7a4b8640d4d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c69d1f8-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624259177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259177, "uuid": "4211bed1-7ede-40e3-9179-726192c1eae1", "comment": "Malware payload (ArkeiStealer)", "value": "48a6907a27e4bd3a8d104ead6d5c41cb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259177, "uuid": "09da93d2-a153-4f65-be52-342311dd554a", "comment": "Malware payload (ArkeiStealer)", "value": "521294dfc8a64a5e31a33afab50041dab893d8b7837bb043e54bf2a9febf19c9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259177, "uuid": "f3205dbb-dcb3-433c-859e-7ee2d14cd99f", "comment": "Malware payload (ArkeiStealer)", "value": "b5a47d1b3bc0cac2a170299acb15c4756ff4088b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259177, "uuid": "494d74b8-4d10-4926-b179-b55b2a620adf", "comment": "Malware payload (ArkeiStealer)", "value": "070b8f32851fed942d5715aabf70e54dc5f6685b58f2f06b66c8aa58007e3e4196c5c6d6a286b61bf929526fb5db911c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259177, "uuid": "08954ad0-f1c9-43d9-83fc-70c78831d911", "value": "E8B55B1869BFD01960B3FE916EDCA8FBDADE55E3240D743B109153178B22B81DE8B439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259177, "uuid": "4b262785-701f-4340-b5b9-9d3123c6c46e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259177, "uuid": "28f9dfac-b511-4a9d-befb-636689f818b7", "value": "24576:Xi4b9OeGL55k+452rmmu9CLKMQeBtNyITKOnU8YDFb+0stbRGU2XG83JqQNhVeu6:X6lm8RpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259177, "uuid": "b06bdc1a-7bc6-4243-968f-c9ad7419d0eb", "value": 2304000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259177, "uuid": "434d635d-d1d5-42db-a346-4e05f5a684e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259177, "uuid": "0d781596-5ec6-4430-b44b-036fc7692be4", "value": "48a6907a27e4bd3a8d104ead6d5c41cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c08f2ce-d2a9-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624291066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291066, "uuid": "7e269d01-956a-46c8-975e-a94e3e8e72dd", "comment": "Malware payload (AsyncRAT)", "value": "fab92456e4fcc6fd70bedf00f19c2d8c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291066, "uuid": "1b11db8c-a3a8-40b2-bbf0-659bb58907b7", "comment": "Malware payload (AsyncRAT)", "value": "52f29bb6b2e4e99819f6bfa47145f13c26c1dcb2a0f88e1833435bd14195c88c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291066, "uuid": "80695543-6d41-4844-8e04-79ded1c140e2", "comment": "Malware payload (AsyncRAT)", "value": "5c4cb16a17d524be9889d63827d156cbb9d2955e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291066, "uuid": "dc5899d1-8471-42c6-bb76-ea18e2140e49", "comment": "Malware payload (AsyncRAT)", "value": "2d3f298c6db8bdd40229650c7fa09d6ca3a1d764bbbf958c9796f9315984b2354a2d199dc0b65a34391d34bb6a11a58d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291066, "uuid": "644d9aa8-c4e9-4b00-8da6-5a071d8e630b", "value": "02D4BE303AEF510EE5779F781AE43AE1966B7E637B07D96C24D4334A97239428F40839", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291066, "uuid": "f2a11197-bc89-4fef-b5db-fbd9b02c1bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291066, "uuid": "cda87fa6-e573-484e-829d-dc94d6a8ec85", "value": "12288:Y3PkTeWFHmsAPc+FFWinuYhCP38G2FLugZNI9HhU:Yk9HuEIWiuYeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624291066, "uuid": "0e64b6de-fff9-4de3-9fd3-be23f9c4579d", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624291066, "uuid": "beb74703-c97b-4a5b-a724-b6e58896e7de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291066, "uuid": "852b0088-996f-4de6-ae37-3ccf80e2946b", "value": "20210621_00394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762f5d1c-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258871, "uuid": "1bf9892d-c929-49f2-9c26-49441fd0ef6e", "comment": "Malware payload (RedLineStealer)", "value": "2477fe1917ec7ef6eee1eb2356d918f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258871, "uuid": "c24a9523-0baa-4f3f-b527-36f8a6dfc28c", "comment": "Malware payload (RedLineStealer)", "value": "53bdf9e84d1c727b2c4cc4ece8ce2060a0543fedb3bf9b5b1dfc5f669797a1aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258871, "uuid": "b99a356c-bd99-416d-bc3c-f1ec150ddfc7", "comment": "Malware payload (RedLineStealer)", "value": "d9661b5769e82dc049df4107c1a32ece49f2a6a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258871, "uuid": "f1b5d4a3-e534-4539-a580-1271757e4a60", "comment": "Malware payload (RedLineStealer)", "value": "f60c75e8661d01ba48df29e9c686ee801c8efb2990751f14577f0c98db3f3790cbfec58a4dafa38c72ae3e82ebfa68ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258871, "uuid": "69008175-ec69-4b5c-8729-2916fe472fdb", "value": "DF84AF10EBA1C035F2F752F84A7A93B8A53D7AA1673450CF12E52ADE5A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258871, "uuid": "42b4791c-cb49-48cc-b7d0-831b24a66935", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258871, "uuid": "f0a5af8c-319e-4de4-91cf-769b7dbf1d78", "value": "6144:mgk2GIGoIiJXj4t3OGhK8PVyx3dVUCVy+lZviChigoI1xTmiKriC:o2GPoIiJT4thK8Pgx3nUCVy+z9hsril", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258871, "uuid": "1bf97e73-6073-42ae-8952-0df4f2fa705f", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258871, "uuid": "8a471fec-dbb4-41b4-8451-9b39abb863c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258871, "uuid": "c013df60-61f5-4636-9c1b-b24d3f2a0890", "value": "2477fe1917ec7ef6eee1eb2356d918f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ba3afb-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303273, "uuid": "ef29f435-429c-4363-a81d-b6e95b91e16d", "comment": "Malware payload", "value": "758650544a4152f1e0102de323649488", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303273, "uuid": "cf0dfb9d-451b-4315-b676-488b7c3b29e5", "comment": "Malware payload", "value": "53db3f71127f11158a1cac73c4ab8452f8f444f41c89da9cc1e4794da9bac99d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303273, "uuid": "d9d0f7ac-8253-4973-8b8c-d4d5096a922f", "comment": "Malware payload", "value": "9ee686fc3e4a51015cb559cbc1d63915413b6b5d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303273, "uuid": "ee7dbe51-22b9-4f58-a69d-935daa8c3ed7", "comment": "Malware payload", "value": "cc9fdfe4ae6d532e7f321d89cfcf40a412630a1b2cee34148b5e3556c257fbd6549c9f910d3c14f8eb4dfbd1c1c5a532", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303273, "uuid": "fc9e5030-38f5-43b1-8d7f-56a7a33a3b16", "value": "5033D008F112DCA0FE1FED78A1F850B076AB16B0F3909DC66C44A55D5DF216D8B2B6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303273, "uuid": "3a1daaa6-72d6-41ca-a668-7e9f88251ba3", "value": "1536:/oH78QIOf7SieU6ZDvxjxcpAr/USvhW7OG:/oH78WSiebvxju4/UchW7OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303273, "uuid": "0957257c-8d3b-41e1-a55d-7d547247c945", "value": 51645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303273, "uuid": "7bd876cc-d108-4ac5-b46e-6215c0814d59", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303273, "uuid": "c828ae8b-2f93-4c3c-ad66-1a8bf6bec093", "value": "statistics 06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5c6e4a-d285-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624275530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275530, "uuid": "afee5fa0-be41-4011-b043-8ca407f5db26", "comment": "Malware payload (NanoCore)", "value": "bfef447d34da27bb1aa0456d93055a90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275530, "uuid": "f4485f12-7d29-42fb-925b-21ba4634873f", "comment": "Malware payload (NanoCore)", "value": "54cc1b8e6d61c5a1eece157947eeca6b7ed0bc59d141d541250332b7b72b9a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275530, "uuid": "e74cc01c-c2c4-49c3-bb67-e4f0123163d8", "comment": "Malware payload (NanoCore)", "value": "5dbb9b52a34da3781e18791dcc8a935c53d02e6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275530, "uuid": "73f57019-0b50-411a-8811-97b848de1efd", "comment": "Malware payload (NanoCore)", "value": "3e6e6ff04ddef51ea5e7473c8edfd023a07a952f5c95d29c7cc1ff09deb40c6d9e953443c3ea68cf78f2cbe3a647e0db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275530, "uuid": "9cd59fb3-10ff-4191-a0b3-2ffa89acdb87", "value": "0805AE20E599D10AEC769A77D990F6F1467A7ED2F60F895B20D43E097773802CA70B38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275530, "uuid": "92403e16-0b5f-4d11-b26e-2da18bde8be9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275530, "uuid": "9f361f7c-c916-4c5d-a796-7d3b4fe6556b", "value": "12288:3MiDOWFHmsuF7bL3xzo8x2sRI6bRKNpyxCWFQGPxj/yF2HhUG:33tHwxe+2/qRKnWFZJTmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624275530, "uuid": "5c0024f4-4e34-4c8a-9f25-788411a9eb7d", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624275530, "uuid": "85b17f65-0677-4274-8e1b-8303320e30c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275530, "uuid": "bf48398e-3b63-492d-8604-ef621e2bdef4", "value": "MINH NAM TRADING - PURCHASE ORDER_34002174.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e718365f-d26e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624265933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265933, "uuid": "ca09d1b9-8f99-44ea-8150-b4211fd61d98", "comment": "Malware payload (Formbook)", "value": "44d30f858fcb66c0fa2b475f60d8f6f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265933, "uuid": "1d1df369-8042-46b5-9357-560d0db4ad9b", "comment": "Malware payload (Formbook)", "value": "556900b033c6969b8c33c7fd00a36e94561acc33357e845876abf791ede3ba27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265933, "uuid": "946226ba-f000-48f0-979c-b1b85d89d884", "comment": "Malware payload (Formbook)", "value": "c57f5c2302d0c5d6066eb1b6b98ab0d99f1514ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265933, "uuid": "ad1a1cd8-19e2-4d74-8c19-4e1c41c67814", "comment": "Malware payload (Formbook)", "value": "ce445fc6f1301b78f3ce9b0d9dd87e1850e8875e6efbd715471391fc78451e99efd8c72ec56f15dc16009e22aa73a616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265933, "uuid": "d5b3bb83-01ff-4734-8c77-0053e7bba2a8", "value": "02E4BF7039EEA20DE577AF781AE436E2967F7E677B07985C24D4234A8723902CF40539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265933, "uuid": "3db00681-4ccd-4fa1-920b-828e048f9101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265933, "uuid": "7db36433-5737-47c2-b221-0892f8574647", "value": "12288:EtJvtWFHmsdP0Bx0CDSSmNGOUmfypuWn7cer/HhU:EX6H7MBfSrHfyAQ7cer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624265933, "uuid": "5aaee04d-7729-4773-8dac-df7b026deaff", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624265933, "uuid": "4efcf0d2-6cb5-43d4-8dd1-2bdbfbc05357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265933, "uuid": "6ae4f6e2-b444-48f2-874d-d61a438c7e4b", "value": "44d30f858fcb66c0fa2b475f60d8f6f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a443154c-d2a3-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1624288584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288584, "uuid": "3f8d49fc-8a52-4935-8b20-c85f9c67fe7a", "comment": "Malware payload (NetWire)", "value": "ac2dd3566161994b4bc2af90113dd6ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288584, "uuid": "9c484e10-3bd6-4372-a599-a2591e8ba3b3", "comment": "Malware payload (NetWire)", "value": "557b7d3dbc3f34338f5a6c1467f399abc0b3ef004d7378b7ff78f80d96fbc244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288584, "uuid": "2e907472-6a19-4f84-b92a-fc57f964e09c", "comment": "Malware payload (NetWire)", "value": "062eab232642c0d9ee9e6af266a8abe9fa14dbac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288584, "uuid": "96f30690-f72b-4c3b-9c85-0ace02bf1023", "comment": "Malware payload (NetWire)", "value": "d09e22b24844c281fc345c2ee25cfc362d5962e989540cc12e40dd4e06d28c8b77f573f1f14b52adec25f0a71815df4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288584, "uuid": "690143b2-35a2-483e-8a69-8abf82291fa6", "value": "CEF4E0343ED99A18F17B9B3A4DD0756197FFF9236713C1293CA1128A4723F81DEA112A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288584, "uuid": "300e37df-c1ac-47fc-9ebd-64e02d22eabe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288584, "uuid": "c7cad28d-98f6-43c5-a60f-6fd9ecefd3c8", "value": "12288:FzSdmzYonM/JnXsANAoVdvf6Sb/G0bXCr4XTAB43s8j24pKzry/WYTlm5/pOWFHS:+qid5TySbNXyn8j24pKzrOWYTC/3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624288584, "uuid": "606be9f9-7bd5-4b71-a750-d7f1bcb84b4d", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624288584, "uuid": "bee1a920-bc47-441d-b575-f2a6ad8ecff5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288584, "uuid": "779a5888-9168-4a09-bc70-6a2fc9d48fa5", "value": "ShippingBLINVPLPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33793a7-d2c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624302380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302380, "uuid": "3550fb85-3349-4eb1-ad78-55d8a3798105", "comment": "Malware payload (Mirai)", "value": "5d32cf8dd2b4c2a898fd4830bef6712f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302380, "uuid": "cd15a0a2-d57f-46ac-9a4b-9f2ee9acf189", "comment": "Malware payload (Mirai)", "value": "55f8f4dbca542f9699bff29f5b2bcb61510f2e94745a37835f02a460c41483f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302380, "uuid": "d653abae-ff3d-46a6-9843-0ef6707593ec", "comment": "Malware payload (Mirai)", "value": "8bf6f9ad42a15daaf396d5fc67f863796fd59a24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302380, "uuid": "2faae2f7-e4ee-4a7e-ae7c-718c696352f1", "comment": "Malware payload (Mirai)", "value": "7c1e665db3f0b24b4066cfb638de444fb832cc3d86dc62de599ad3b4d607d0e769393b996d2132aaf8dfbd4b3887388d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302380, "uuid": "c2bf6cf5-4b94-4012-84ed-c2e2fae56452", "value": "0933016C071624D9F2E45172C6FE83792A7D4BD60D9BEC8B399053CA4F50479B116EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302380, "uuid": "3e791407-c8a7-4e51-b276-396b3a596c30", "value": "1536:B5iq/+jh+vCwydDVfVJuj+iTf3PRW6T8qCz:qE+jdwy1FVQ1L3pWBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302380, "uuid": "17acc851-bc27-476c-baf4-8037535d4db6", "value": 54616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302380, "uuid": "740a925c-b0bd-499d-883a-5b3432ded131", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302380, "uuid": "a78a760a-a0e9-4ea9-bf05-3c6f039e13a7", "value": "5d32cf8dd2b4c2a898fd4830bef6712f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8be144-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624303447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303447, "uuid": "4c7eca56-c4c6-4d50-ba02-d6f482b31ac9", "comment": "Malware payload (Formbook)", "value": "bf34896fa20667412fdfc4f2da5b2b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303447, "uuid": "b490c74d-e675-4a20-a243-2cb4573c90b2", "comment": "Malware payload (Formbook)", "value": "5810c640bb4219ca39bc8a0c8b50f8447e5e47784e75dfdacdce65d5d2c31e47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303447, "uuid": "cbd24ca1-9be9-4140-92c5-f3dc7c50f1d7", "comment": "Malware payload (Formbook)", "value": "7af4a5bbb6e45110543cff78a221075cea4de721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303447, "uuid": "8b4875fb-b056-40a4-a609-9083e421ab51", "comment": "Malware payload (Formbook)", "value": "145ee685eb2e4b0fec4b41866a8410c1d21f806e68ea7ac4bd53510dc16150b3d95f991a98f9bee78c1afd8817723446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303447, "uuid": "defda103-8492-49d6-a84c-aa7255269ac3", "value": "E2F4E1303AE95615F27BEF3A55D472915BFEB623A303C5593DA0038A0723E81DEE153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303447, "uuid": "fe07ed16-7551-466b-8b61-b071abfaca6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303447, "uuid": "ed67a1c1-16e2-48f1-8a6b-998fb35f6d8b", "value": "12288:mz2WFHmst7SPQnpAVH2rXOqoZ/wNQm0G+oB7hXC/2aEMnJWYTl:glHT7SPQuFT/80GVBlX/MnJWYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303447, "uuid": "b44b5528-940e-4dd1-ab42-cb1518efd77b", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303447, "uuid": "c4e6a228-04b2-4216-a548-4d3fdc4b774f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303447, "uuid": "e08c4196-7e1d-4083-b5c6-6488285fd4fc", "value": "Payment update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc115d0a-d2ba-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624298556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298556, "uuid": "61400129-6ae1-499f-a3d5-5d8da1292185", "comment": "Malware payload", "value": "674fd0ba8516b6c0becf887873d20e37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298556, "uuid": "a44ac527-fbf4-4ca7-80fc-1d13f1390364", "comment": "Malware payload", "value": "582bd95cb373746cf791798e2d4ac5cea02740fe1cf6d03b5990ac2c88484c5e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298556, "uuid": "474d6526-e2e4-4c41-9933-825ed9024bdb", "comment": "Malware payload", "value": "9736c144cf145b302eaff4137cb862b33e2bde8c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298556, "uuid": "9df1d3b5-9309-4409-a9ce-b968965ee8f1", "comment": "Malware payload", "value": "eb4e62355abdc4de12775461318368c4be2203a5dcb550fbc3e8a93a1462659864b33239effc1c4e46c4372d7c90369b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298556, "uuid": "40a76b25-487f-41f7-a041-3b66f22bac11", "value": "396412ABC8FA89CEFE6E4FB5265B0D0F0EF6E1D4E5C53D94452A00802BF83566514F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298556, "uuid": "4210a1c3-40a8-44f9-a01f-7f1837fb4e8a", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298556, "uuid": "7acebbdf-2b2e-4a04-a908-4d4c25f6eae1", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298556, "uuid": "ffd22cb8-4bb7-49dd-95b6-ee1664f5ba3e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298556, "uuid": "ee9253db-1118-4b3a-bcc9-bafd504f0753", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb84086-d256-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624255310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255310, "uuid": "c3d5bb38-20b7-431a-9067-97703458b91f", "comment": "Malware payload (AgentTesla)", "value": "ff71ae6c972592026c0edf176627eb83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255310, "uuid": "da52c5a0-8bb9-4403-9360-1b8fb67bce44", "comment": "Malware payload (AgentTesla)", "value": "58bc6b10c47e8c17fa5037f5c4592711961d90e5225bc94a286ba6a02d617af3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255310, "uuid": "83591d83-fc81-4889-a086-318840be8fc3", "comment": "Malware payload (AgentTesla)", "value": "8600621b3c7eba428361f4d17298b99b530e0a17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255310, "uuid": "152b516e-7e77-47a9-b933-ebb292e293f1", "comment": "Malware payload (AgentTesla)", "value": "d69d9cf5e75b62817ae5fc12d27b2114b4f1a119f4c3406693a5ebcf207328840a93f3df1cfadbe496f03a27fe2968a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255310, "uuid": "c5eb88ee-d254-4218-abf8-6b451126c723", "value": "5EC42342CB5C43329D9F99B0D8807E652D2A5CCFBF455BB04C92008F9B6E2AD6570BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255310, "uuid": "8db54442-cea8-45d4-9410-be9e3d70902c", "value": "12288:RWQZii7Mpe8ccTKJjgvMlwkqu5ShhjP0/A9rED/LKtLvjpYuCl:RWKiiIpbNMlT5S/jM/ANED/2tLtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255310, "uuid": "e8d3e380-8061-4a55-aac8-ed9a8ddaf65f", "value": 577747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255310, "uuid": "2097907f-d0e6-4afe-b203-9bdb15db49c5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255310, "uuid": "4e12e374-adfb-413c-b631-d3f89409b644", "value": "memorandum.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcadfe61-d25c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624258184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258184, "uuid": "54a06dad-66e0-4f2c-bb54-6262ca323fda", "comment": "Malware payload (AgentTesla)", "value": "9a66ecbfd70181fff978a0c0801d89c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258184, "uuid": "5c93845b-4266-4dfb-b1ad-432bfd0bdc00", "comment": "Malware payload (AgentTesla)", "value": "58ca08b8c55584645392741566f33d8f048f4936a569f0f3c2dd20cbfdafdb6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258184, "uuid": "34c79771-6b5f-411e-869f-a4eb685ff666", "comment": "Malware payload (AgentTesla)", "value": "79fa46006893271c2ad549455a2ef378938637a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258184, "uuid": "523600e3-d727-4517-b250-381ccee41626", "comment": "Malware payload (AgentTesla)", "value": "2f349eb6409f07eaa97d2ec7969c8b2adf1206325132feefcc86421f8c1e5eb628fdb0b2434b658bb0350d5e8cef2a51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258184, "uuid": "c8279e73-6127-4a06-af8e-ac49c27203ce", "value": "F42523A7BEAC8F53D21B20B5B807D399029DDE746204C693B619B87136F9BB4D0D342D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258184, "uuid": "12631c5b-b67b-472c-aba5-465cf8768fc0", "value": "24576:xDqvIjcq31dqEu4Qx1zys41BLUCuAxLi0njSvrsPW:RqA44PqFz9OdLi0nuj4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258184, "uuid": "7784dad2-5e91-4979-91c7-4860c2817431", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258184, "uuid": "4c570292-e877-4f21-b810-0b469aa95a40", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258184, "uuid": "0c6d72c3-b0ea-4eb1-bb5d-a26261dceab8", "value": "DHL SHIPMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7ba7ab-d265-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624261885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261885, "uuid": "85b7cb77-1f03-496e-ba94-515cb49d1622", "comment": "Malware payload (RedLineStealer)", "value": "597402481c5e696d7fc155e9b8855771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261885, "uuid": "a2e8bb6f-34af-4d21-ab64-a6fd885ef9cf", "comment": "Malware payload (RedLineStealer)", "value": "59395518c1daad6b8f63ee71ad7a5dbbf79f718fddcc2932fc9bd99a4820b32e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261885, "uuid": "388e56ef-2320-4426-9340-dcf40858fe66", "comment": "Malware payload (RedLineStealer)", "value": "71f5fec965bd4b440ea8692fd5c6df356a3f0163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261885, "uuid": "d3c18886-7cbb-4583-9a35-47f9c0b1aad3", "comment": "Malware payload (RedLineStealer)", "value": "1308e5ac08a07c11a5d61862f5985e2c29ff3f99f5d4b36b7a4d8cb8af5eeba076d33759d7351615ee7992515a0abe03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261885, "uuid": "7782c587-d91a-4e7b-909d-15e0836d3a79", "value": "1384672868BFC05984E3EEA12DDCA8FBD99A55E7640C703701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261885, "uuid": "a8a8d1ab-b45a-4bc6-814d-54287dc78c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261885, "uuid": "5bd67fd3-c350-41ed-8e44-04e970aec676", "value": "12288:G6zalveIP2Pouc9fqWbTfHX8CbiGKtV2pnZ3/8sEXdr:Lpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624261885, "uuid": "93ac194d-1d68-4e42-a315-1db67386eaff", "value": 404336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624261885, "uuid": "ec763df1-5f75-41f5-b7dc-92cc5a5197c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261885, "uuid": "be97ac93-2cea-4c37-aff1-e1e36a2d1358", "value": "597402481c5e696d7fc155e9b8855771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf5c9cc-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315360, "uuid": "aaa9460b-cf1d-43ad-b4fd-e2eae06a009c", "comment": "Malware payload", "value": "1ad8ff9aec9ef2eb606e8412089d932a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315360, "uuid": "d14fb8ed-8a1e-4e72-b74f-619c55b0af0e", "comment": "Malware payload", "value": "59e61b5ec3eb024ce68f9011a69ccb617120fb95100835d173e44c8dc4d08924", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315360, "uuid": "faae6ccd-40be-4a18-887e-b71a0587d3e4", "comment": "Malware payload", "value": "5c5bb5a9a19f5c946ba299b7d92d068c7b5e99b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315360, "uuid": "8c44cbfb-cca6-4e88-b285-b5a757e71a26", "comment": "Malware payload", "value": "e09d53c9af3dbd642cef869cc68d3d8fab263bc390f2a88817a552ac74f945dc5ebf33c9e1a1db444a8c8aedee974836", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315360, "uuid": "80fbe1cb-e92c-4404-b01f-004192a1b991", "value": "B404D026E2E556CDD24716771319B3373214F42A42EAD2A3FF2CDAD2C097AF84414D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315360, "uuid": "eaf70df0-9569-4f80-a68c-c7eac66fffa7", "value": "14c75779b7b4d62acd0d37b3afcd3c4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315360, "uuid": "4228a0d4-4ed5-467c-a799-98cf33d00edd", "value": "3072:EZUVAk9rsXo3/Ifz/uUXF2mSPBxv1tM7lt8jPU6/pyagsuAtlUucGZ2:EUAk9I4vgz/V2dulz6/hvOhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315360, "uuid": "791067c2-fe56-47a6-8df7-3b6c73f8d256", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315360, "uuid": "5ce3af63-c7af-4c75-aedc-a8875008b159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315360, "uuid": "c0511ceb-fb31-41bb-a34c-1fc776532b80", "value": "e71MPsqjNpHOnVG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662b0149-d2ca-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624305230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305230, "uuid": "de21366c-baa1-47c6-8e8d-3dab3aabbec9", "comment": "Malware payload (CobaltStrike)", "value": "fb4bcc37fac4190896ec5b4785cc7d90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305230, "uuid": "ae29aa72-8d74-46a8-b279-0d7d7d9a421e", "comment": "Malware payload (CobaltStrike)", "value": "5b11998f63458e0c8f86b101bfa4c08d4d523417dd4763c65712b73e5258d434", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305230, "uuid": "4ea6d2de-1f4d-4fac-bcdd-839382f55495", "comment": "Malware payload (CobaltStrike)", "value": "a238f0b22913bf2c6983136fde621a3262819374", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305230, "uuid": "04b43941-c295-4193-81dd-737136718c44", "comment": "Malware payload (CobaltStrike)", "value": "0e1fc1903d9cef7e6837565c9dfc56d8af0696af56b7cd8d169e02ae85f20f32742a8eba513f0cd2e01f0da6acb59339", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305230, "uuid": "7670e5eb-cbda-4841-b0c3-b16af1de6b3f", "value": "3E64C14DCA8B417687FED3BC106DB97BC80A0A1DA9F736D537B29461D69070B1CEB209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305230, "uuid": "b62a4c7f-1994-41b6-aac3-3d4085af4f12", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305230, "uuid": "de78c5d0-9fcf-4d15-81a6-94a4ef69b1a1", "value": "6144:k1YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:aYlNRmFJC8y9hrqGdVt5rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624305230, "uuid": "92d2515e-64a0-4a7a-9a58-0265ca1a66a4", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624305230, "uuid": "7f20231f-f957-4bc9-a264-cf52deba99c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305230, "uuid": "1551243a-d5c5-4ab7-a328-ed9d8ca2d581", "value": "fb4bcc37fac4190896ec5b4785cc7d90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad82d441-d29f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624286881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286881, "uuid": "7be6a865-f727-4b0d-98df-15b8a45083dc", "comment": "Malware payload", "value": "7ba2606a5d6de4768f0608c644bdb764", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286881, "uuid": "0c71eff5-0d9e-42fc-8b50-1b1dcb87f155", "comment": "Malware payload", "value": "5ccf66192ea9d2b6395fbb4a058d0af8409040d6d38b82b7fa1bf120371e9538", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286881, "uuid": "e5bc5b80-7be3-4f5c-9d55-f83da6c5c252", "comment": "Malware payload", "value": "8ba2faee8cacf4ca2ae5b83a2c1c78919dc902b8", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286881, "uuid": "32ea250b-9982-4b06-b461-1e5219edd564", "comment": "Malware payload", "value": "7920ce765aa8f7b88952ed50a6fdf77a82179c1e10edcfb9865c81edf9fafeb7c640bab83bbf8fd3d68767e570bdbc75", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286881, "uuid": "5cb9772b-2936-49a9-adc7-942cf6349f13", "value": "07D3297D34CCBD20EDA7DFB4811F9469422B72512906E823515E4AD86DAABFD6B03C0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286881, "uuid": "e1e87035-717d-4e7b-92c7-fe34f9b06c9d", "value": "3072:eyo3Xs9FFBYrZ8aKzNJqyu29UvHYxrXqYqugeZZnDMfYOsh:ey2s9FDYrZ8agQ2eHYFtaADdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624286881, "uuid": "74ae5c63-4be8-43fd-a7f9-ad6e46f29ff6", "value": 138416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624286881, "uuid": "04691f75-8860-4fa2-8a9b-1f078b15f9ec", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286881, "uuid": "67031161-837b-4f46-8a88-0fc0f1e6e85b", "value": "5ccf66192ea9d2b6395fbb4a058d0af8409040d6d38b82b7fa1bf120371e9538.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb403b96-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303252, "uuid": "6ea19ad5-9b4d-4380-8605-3f0f0250ffe8", "comment": "Malware payload", "value": "28d2b0c16c8762f6b993531f165e23c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303252, "uuid": "fcf0e64d-fe28-467b-9a2c-5291c709589c", "comment": "Malware payload", "value": "5d072a554bd078f6a4d47b12cb5079b399a55992f41903d50f2d0dbaf065fc16", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303252, "uuid": "f685a0d0-5935-4820-b4e6-08bba6324e81", "comment": "Malware payload", "value": "b93866c8e682897df486a02a45ae441f235b25b2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303252, "uuid": "1bc6fe38-d55f-40c6-971c-08ecb08869b2", "comment": "Malware payload", "value": "9fd59177e495f678db5fb8a662fa437ecf0acbfe8799afeab15ba2df54cc7636bad46a3c1401c87d99a2c4941be8dc91", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303252, "uuid": "2e9abdb0-9610-4425-9a61-c0a2070d4e6f", "value": "9B33C054F101DC50DF2EED78A5BA20B0B6AB06F4F390AC966C80D25D59B106D8F3B7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303252, "uuid": "63e793d9-2b4e-4ea7-818d-7c4af3c291b9", "value": "1536:/5DSIQIOf7SieU6ZDvxjxcpAr/USvhWyUh:/kIWSiebvxju4/UchWlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303252, "uuid": "943bf224-dbf1-4748-804c-1d8c2083bde2", "value": 51342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303252, "uuid": "ab84b87a-4c05-4b9b-9bbd-1294d8de75ad", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303252, "uuid": "21f3bcfe-26c2-46a0-8357-19e79e29dbce", "value": "specifics.06.21.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ec1772-d285-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624275455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275455, "uuid": "dbd23823-0e07-4f87-9b76-cbfaa6dbaff3", "comment": "Malware payload (AgentTesla)", "value": "f14097b30e698d7b7dbcf514f9b39113", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275455, "uuid": "710b83c8-ddb7-47f6-8715-e23525afba64", "comment": "Malware payload (AgentTesla)", "value": "5dc0ae1ef10497379bb77e09ca8aa5849f5caa2409ecb993ed57677e9914d1d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275455, "uuid": "9eb788b4-8215-46bc-9875-59d175bfc950", "comment": "Malware payload (AgentTesla)", "value": "11865444a6a6ced7fa7b6c1b7b25d27648977ff6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275455, "uuid": "ba17259c-b9fe-4161-95bf-da7ede521e3a", "comment": "Malware payload (AgentTesla)", "value": "44cf7e74067bd97a5304ff32d30655c548053e19c40cff1d0ef33ba3671350ff38946f59a27a21cfb3515fa5019763e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275455, "uuid": "833065fb-2c01-4630-9863-5db40a3ae6b2", "value": "3AC4E02035B81B22D1FD8BF55AB576104FFA722F741EE6180CD621EF16A2F014EA1D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275455, "uuid": "125d6fa5-5031-4c68-8779-b314d1ef62a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275455, "uuid": "db4b84cc-c517-41dc-8a2c-326d335ab052", "value": "12288:LhB75B7TK7hg7xxJKFYON69/skaRkZZJkSfZiaIj3ssSAmS1VYUkHTy7ee6+UCz8:JOZGZSCgosSAmS1Vfkuie6vCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624275455, "uuid": "a23c5172-4fa4-4808-9ea9-e3c7a939b66c", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624275455, "uuid": "eaf7efa1-799a-4068-b0a6-3b0ed60667d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275455, "uuid": "83c942a9-b7ca-4f40-918d-a07ed6d83153", "value": "OPH21-000080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba7287d-d250-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624252814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252814, "uuid": "6717ea78-a639-485b-b8a1-c0c4a35378cb", "comment": "Malware payload (AgentTesla)", "value": "b1e73d4ebd938e3373a6a957255bfee1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252814, "uuid": "a5dd90b3-494d-41a5-a46c-a08ffeea78aa", "comment": "Malware payload (AgentTesla)", "value": "5e32b9920fbd332179288fbc1d5ed94f83e0cf164a28b8c63d20e5d0b8949f37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252814, "uuid": "fea1b745-a020-4f31-8de4-b67161af12a5", "comment": "Malware payload (AgentTesla)", "value": "599d8a25e0297dbeffa706c525d60509e76f844b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252814, "uuid": "ffd7bf7c-9ae9-437d-8798-14f8f364376f", "comment": "Malware payload (AgentTesla)", "value": "31fee7360e3efbd9569678daaac02a34a1ecd3ec5a0c179bc58e664eb7eb7acfa0c3a9e407dadc2ab6753c8815b0f937", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252814, "uuid": "46c11619-9e74-4d22-a419-4d6e8420f8b5", "value": "2D2519AD325076DFC86BCD76CA682C68EB90747B930BE243A05315ECAA4D957DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252814, "uuid": "86e84db6-a1a7-4741-81e1-71baeb7614ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252814, "uuid": "4ef58676-aaa1-4478-b447-4257f71546ba", "value": "12288:knk3RBaQeoyA+7SoBMoofwNkKXwGkDff6ym+dk5S4p/hl9v/1nVWflfkkgIIfr4g:kk3RBaloyA+7lojLbjxkfthl9vVVQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624252814, "uuid": "6f874c54-e486-4d96-980a-a4f107fcccd2", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624252814, "uuid": "5018aa4a-4ba3-47ae-a5fe-ee6e7a75a596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252814, "uuid": "e4879369-9794-4187-b3c6-1b35ffd6e6bf", "value": "Bank Betails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28562c6-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624287319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287319, "uuid": "e06f188a-6c5e-4520-b9b9-a9a5561b8b51", "comment": "Malware payload (AgentTesla)", "value": "14d4c27cbf647802f13e670b3d741bd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287319, "uuid": "95915ac0-5af8-4e07-ab76-2631f9ab64a3", "comment": "Malware payload (AgentTesla)", "value": "5ec8862ce178a2021c0e1a77a38d6265bbaf3afe4800e7dfe4b45554f114d752", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287319, "uuid": "910abf7b-8944-46b5-a3d5-a41bae076b85", "comment": "Malware payload (AgentTesla)", "value": "0677c49d1d3e0513e32fc2ad4eae51e68978e2c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287319, "uuid": "cb7611aa-943f-4bd2-9dc2-a0400fbe5bd9", "comment": "Malware payload (AgentTesla)", "value": "59fd3f81c478ac4cf07ac2ce82e925eb3b05aaf343a37f2a0fc53fddffd6f9748bfb4e7d0e74b43d2c8ef00da187b0ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287319, "uuid": "a7ed2c67-2a6a-4f37-b025-08a430bba92a", "value": "5D559E92A9CD849EE57B0EF16F35AC3110B3BE9D2554810C2DD8771EA673382A4DFD0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287319, "uuid": "fd0890e8-2d51-4f99-a962-a99705fc79f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287319, "uuid": "3f0611e4-dff2-4d91-b341-c5253bb699c6", "value": "12288:Ph7WFHmsdSMPQipP5EGn+6GtoQl1kCGP6Ki5rsgDL5CwF9EXC2esXW:JEHiipGGn+6GtoQaP3iqC4wF94Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287319, "uuid": "2e889119-a9d3-4708-9e4c-e1d491f6659f", "value": 1348608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287319, "uuid": "0c11bbd0-daba-4223-8972-947c88970536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287319, "uuid": "afee51c5-f669-44e7-ae4b-56c42a9fc8bc", "value": "14d4c27cbf647802f13e670b3d741bd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d42aae8-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258883, "uuid": "21f35a32-c206-4ab6-9793-89be61ec716d", "comment": "Malware payload (RedLineStealer)", "value": "b75de0a54781e3de02d7a29aa66ccd4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258883, "uuid": "0388f8bb-5725-4632-9b91-c6f61170550c", "comment": "Malware payload (RedLineStealer)", "value": "5ecc6a41e269a3c7be68ddcfb38322fc357fb8208055e7573fa47fc36f5c32e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258883, "uuid": "122bb43e-ddb6-4db2-b756-90837377b6a4", "comment": "Malware payload (RedLineStealer)", "value": "ffd2f1331f9127a51e2d6004878ed14bf2c53093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258883, "uuid": "2d7d86cd-3afe-4e7b-bef8-1b55b5dff47e", "comment": "Malware payload (RedLineStealer)", "value": "832f731303bde306ddef594f208cf28c9f65c44166b4b3f5eee1df036eb8899ef4dea51265985d6c44b0c1a6fa9e3396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258883, "uuid": "356186cc-3246-4cc3-baa9-5add746e4477", "value": "5A84AF01F6A1C035F2F762F45A7A93BCA93D7AA16B3450CF12D52ADA5A347E0AD31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258883, "uuid": "79f77eb4-f845-4ca6-822a-3cfe0c2ed459", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258883, "uuid": "ce1c8b5f-4cd1-4d52-a77b-003f130ebf53", "value": "6144:hgk2GIGoIiJXj4t3OGhK83ajrZ34gAmez03SiohmMn/Pvhioo8q1WBKriC:T2GPoIiJT4thK8Kx34T/rsKHvhkQBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258883, "uuid": "01b937d9-ef38-4ad5-ba7d-eaf4083cf5ee", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258883, "uuid": "ed5d71df-135c-4005-b036-c7dcb57c5b4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258883, "uuid": "68578a76-8f85-4807-a4e5-4ec91c156a2d", "value": "b75de0a54781e3de02d7a29aa66ccd4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b1f81c-d264-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624261370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261370, "uuid": "94e50382-1540-4283-addb-dc0e071978da", "comment": "Malware payload", "value": "72eabb4aebfc3d4efd52b64d04847747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261370, "uuid": "14de68a6-4ec1-4653-bd88-1d4408dca454", "comment": "Malware payload", "value": "5ed99560a586a1f8b6ee3daaeb1bad3eab23a6f98f70bac004f470082d6c1e32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261370, "uuid": "b1e9de35-3d62-4347-8cb5-a4452efcdef8", "comment": "Malware payload", "value": "f7dcf49ca6c6426d321e04a025c16846d936aeba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261370, "uuid": "0041ed9b-58e6-4351-8be9-ab2b4738af50", "comment": "Malware payload", "value": "f4b8e1eac601447e09fd5599f389b2b5933380e3b16fd87211984b748a23a4ab9e65f90f6e1d8c55539920bc62809150", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261370, "uuid": "54d72c85-51a0-456a-9fe1-5e3b4ea9899b", "value": "594523513B5456BAE5ED4A724C23AE290E32FC34D9E0C95A7251FF9D3C321029728FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261370, "uuid": "6b2faf06-d889-4650-b798-d5778bd47cde", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261370, "uuid": "b1ed0e7d-eefc-4d6d-b20d-67289946b62a", "value": "24576:mM/V1ZY4L/eDTAXKvTSTFcmXQnH4Owz2D/pNiuIdqt/tent4:1V1Z7/Q1vgcGXz2D3ibdqt/tAt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624261370, "uuid": "8f94e5df-500e-45d4-a31e-53e578d3eb95", "value": 1206476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624261370, "uuid": "5161a2ca-b989-4e9f-87b3-7f13152eec66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261370, "uuid": "b5d3af52-40e0-4b64-bbb1-53bbf7c40441", "value": "72eabb4aebfc3d4efd52b64d04847747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6553e8b-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624287406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287406, "uuid": "df389628-e1e7-438f-8788-4c1fde59915f", "comment": "Malware payload (AgentTesla)", "value": "3b90f2f813afc779bc05979f9ff1dda4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287406, "uuid": "88d57db0-f585-4f90-9cd5-89c0dbefd38f", "comment": "Malware payload (AgentTesla)", "value": "5fa21f1c452f6786cd93f484b5d719a1c261681d8393848608f224e8356e22dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287406, "uuid": "9653bca4-20c0-4a28-ab52-006c5676af27", "comment": "Malware payload (AgentTesla)", "value": "186762dd739388d08f78b50dd70782d6d5dcf8da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287406, "uuid": "d8b4f4df-2522-4445-a920-ce767fd49f92", "comment": "Malware payload (AgentTesla)", "value": "d7d13cd95d61e698755ac9ae13d23f82c025b280db2d94dafde29d783cc4eef6ebce551cd61be35cc5c3d04e598e38a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287406, "uuid": "c0a71561-3c1e-42b3-ba4f-9b6bc23c8e6b", "value": "3EE4BF3039EE510DE577AF742AE436E2967FBE677B07D85C24E4234A4B239428F40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287406, "uuid": "f6710d8e-987f-47b6-b09f-1cbff53237c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287406, "uuid": "dab72504-354f-4777-9c29-a6b02e00c612", "value": "12288:wN94pXWFHms5CaQ0dKi05c2K9HlmXKQju2deaQGQqeDThlWVgAiHhU:w2oHjCaK5tcHQhX8ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287406, "uuid": "5c351df1-1e30-4070-a53e-627104dc534d", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287406, "uuid": "63c334c1-9994-41d4-915f-54bcf62c4141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287406, "uuid": "112d7f73-f667-430e-9b83-78b18839c190", "value": "f7TYg3vsyMmsdwu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e908985-d2e3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315901, "uuid": "fd430714-53e0-4055-9159-1525c7dcf052", "comment": "Malware payload", "value": "c4228f4d5aeea11367e934bff24f07f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315901, "uuid": "e8ba4748-32f5-4ad7-afc4-9fb7e4f4a2e9", "comment": "Malware payload", "value": "5fd2e4026b6bb43f4038b3628b6bec78c417676eef6b514fd3398cec3b9f755c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315901, "uuid": "9fba4586-450e-40e9-b729-ce0c029f6d86", "comment": "Malware payload", "value": "4838c8558aebebf153b0b02d659baff4884f5abd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315901, "uuid": "80226c06-e6af-4e80-ac41-ea744cc6a7c2", "comment": "Malware payload", "value": "a75c906d348494da3f565ce16f697854fb35790a154f3ad4e65d0fea02e44cbab1aca1291534ca8aa242931f0fafa7b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315901, "uuid": "7b2f7053-3ed6-4ee1-97b1-8d12cadf4e0a", "value": "0104D01FEAD706CDE337AA333A5D732B62C45612DF19D0A8CE14D2FBC1B14904A81A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315901, "uuid": "191e5759-f9fb-4f1c-9085-11e6950f886b", "value": "b380277cbb8ae5571489cb34552d83fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315901, "uuid": "fa936b52-0fa6-4f58-9ec5-24574002924d", "value": "3072:UuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:ozWxkOP4p2EesvcDi6DOHPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315901, "uuid": "f493d55c-3c5e-4cc5-ae88-2fba33eaff52", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315901, "uuid": "9ae9ff20-2d4c-4be3-b818-69c0507697a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315901, "uuid": "79e3ceee-1ebe-4e57-97a4-52d6551e19d1", "value": "tChCU6DDwk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa890740-d2ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624305479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305479, "uuid": "1118a2cd-21a3-4c8c-9aa2-45d7322764de", "comment": "Malware payload (Mirai)", "value": "ebd60662d81626098b584d7507aefbc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305479, "uuid": "a240f72f-51c5-45b8-8c5f-9ebb87c0ce44", "comment": "Malware payload (Mirai)", "value": "61ff2179883aa255e6a14b55d8d7611315d80e921a723309b88c624bfb259f4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305479, "uuid": "47d15c39-7122-4e48-803e-00ec7a15994b", "comment": "Malware payload (Mirai)", "value": "adb5940372df85857f53f1be3e2850ddb960397e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305479, "uuid": "4ad6d6ea-0af8-4b2c-90b4-c235d33bb889", "comment": "Malware payload (Mirai)", "value": "3776958fd7ff6ba2ba677ff985e545d2ff799a6df8cf39c3ea21a40c0e2a9e23ba3c2ff7776df5833b278239cb641c50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305479, "uuid": "0314b563-6630-485a-bc61-b83c79610624", "value": "15E2F100A525ECE3D9F00D77F5784A0617621DE2B5D6720F013044F994BA5BBAABAFD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305479, "uuid": "504b9922-1ef6-47d2-b236-21261e414661", "value": "768:jbSlsLzKRVIexti/B1DVrLcuMFXyUT2hCtm3Uv:3wsiMexti/BTLKFiUtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624305479, "uuid": "aa8d74e6-6cfe-4c07-8040-712521d1ae5f", "value": 31888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624305479, "uuid": "6c60a74d-1ffe-4eea-8c30-353cbbc0d77e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305479, "uuid": "435ba109-3cfb-4002-93e1-80e174006e75", "value": "ebd60662d81626098b584d7507aefbc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59709339-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303491, "uuid": "0e4c5b4e-4c6c-4918-aac0-3594bd3b32ed", "comment": "Malware payload", "value": "61bb0da14c73e41282488c02c9990fe9", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303491, "uuid": "a385f563-224f-41ec-a2b6-697aa62ce8a6", "comment": "Malware payload", "value": "625563aa593e5d238bfa1787b9549b1a9a152147642a603b10bb472268cb7df4", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303491, "uuid": "7716e069-fd8b-4b9f-9723-af1c79d7c55b", "comment": "Malware payload", "value": "13137a7a2743c32e0e987f96f6c2e74f527adf2b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303491, "uuid": "60ac19ba-2c1d-4890-915c-1a0e091408b2", "comment": "Malware payload", "value": "ef1051626092ea1ddd8920b747db81cf1b031960d40a798dbbc8fd0879c0edd65c76f07a83509b2b104a7c49824f9e50", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303491, "uuid": "5a13bcb7-99ee-4e2e-95b4-08d412e1889f", "value": "9751B5CBEC53DE1C01332C521A38D48998158A2003D2D42989C9EDC77D92AF8CFAB7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303491, "uuid": "889913e5-f89a-4b24-8510-108d1b36ef16", "value": "48:VWRmu2qYEj1CM3IRp5GLkMtKapLgXanE1CTtHGROxqE8qgY3le9xHftw/Ay5Wu9k:gRmu2q78UIRp5GwMkalgXaIaxGQ4bY36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303491, "uuid": "d4449d32-0bd5-4021-972f-1609c1303170", "value": 2884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303491, "uuid": "b9e09e8b-1d83-4b86-90a8-6df580fe592e", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303491, "uuid": "b8332e87-310c-415a-a188-2a51ded7e483", "value": "bytesRCount.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94529b11-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624258922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258922, "uuid": "1eead104-e122-4a7f-b04a-63c13d30fdeb", "comment": "Malware payload", "value": "00c99ac957aafe7a9edcfb94cdf51b4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258922, "uuid": "67926df0-0059-403f-8841-f634b62e08eb", "comment": "Malware payload", "value": "62778ccb7df0b670ccc24269c64459259633d6dfdec48e99fd385e2dba3864d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258922, "uuid": "a9be896b-25e8-4bf2-b9e2-96d7bbecebb0", "comment": "Malware payload", "value": "8a18c7c3a9505794cd6b8e928615f60293dc1eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258922, "uuid": "56e74c13-7300-4d2a-bbe6-a6f570636170", "comment": "Malware payload", "value": "01a21107d795e897efb390d4068c4721e7868e45ad4e661cb82b1cb300f3b764cdd79793b04543c330787820d5917c71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258922, "uuid": "910a2e0c-832f-4c73-9b0a-5de034761339", "value": "FD13946A10507158E6E349B52C61FD783B28E7725C80D14EE426865CCF82AFB78ECDDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258922, "uuid": "26c8e5d9-fcef-4be5-8c05-e27af186e571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258922, "uuid": "abdc2b92-1552-4c58-a3bc-e6ecb4b61ffd", "value": "768:n/MLJ5XeqcVxPUvBNRHg4deQAXrgM2i7XvShKV:nK5OqcVMTRt+rr7XvFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258922, "uuid": "92ba6838-95d0-4933-8e93-fb03f4bb6583", "value": 41464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258922, "uuid": "d038093f-c9a1-4810-a853-532be9a12e40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258922, "uuid": "be2cfbbd-7679-44ca-91bd-44098d6ca1f8", "value": "00c99ac957aafe7a9edcfb94cdf51b4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b9bfbf-d25a-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624257126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257126, "uuid": "609c4784-c208-446d-b2d3-2c4256cfea9f", "comment": "Malware payload (NanoCore)", "value": "6eaaaf715adf38ff35612f6a3348add7", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257126, "uuid": "bd61d6b4-7204-4e65-a02e-c62bb46a8181", "comment": "Malware payload (NanoCore)", "value": "630f32119777742bf896762f00502adb777e5137784936f6b06ac1eea3f2cc8c", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257126, "uuid": "ccdc4c09-7583-4b44-8639-eebcddba9f16", "comment": "Malware payload (NanoCore)", "value": "23e9977f2eeda1d5f32b7e50a300788a3cfbdc46", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257126, "uuid": "bb682ea0-7b88-42cc-a209-57731ac30590", "comment": "Malware payload (NanoCore)", "value": "d08ef7181ee8462eb55af8add23012b605662fa266c5e57b133579174c540c51a5c33d44e8f2d3822ce6f5ad85750f40", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257126, "uuid": "9ecdbbea-4c0e-45ae-ae48-6baecd4f5e19", "value": "764523F2FED2C78DFF6819720523802D45D5CE543A56802F528A37AB93742BB17A392D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257126, "uuid": "b9315493-771e-4c1e-a267-e87f2aec532b", "value": "24576:qzNDBUBgFU/uc37mvjdWY9m+6Ma9Wdg3jRy1JIXVLMY974c7:qRsx2gKcYvZNg31yMV4Y974E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257126, "uuid": "c174d252-96c7-4b17-9c53-47cadbe1334e", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257126, "uuid": "c5ee2c56-3df2-4040-9538-07778f3b2f21", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257126, "uuid": "80c82a48-bc3b-4d6a-95e5-42144d70e2c4", "value": "PO-MT2249C.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02502149-d2a5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624289171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624289171, "uuid": "2ec094ed-bb74-41a5-80fa-0f6f6b22b0af", "comment": "Malware payload (AgentTesla)", "value": "6b11fceff3109b5e53de5a51e11e3274", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624289171, "uuid": "6a98303b-5a82-4be5-afa7-d2c7897283ed", "comment": "Malware payload (AgentTesla)", "value": "63cc7593ecc74d78b39a46559da7124216bb5bc0e9eed2d7996717c462871ea6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624289171, "uuid": "e3d91283-213d-4164-a7d0-f4361ceb6ae0", "comment": "Malware payload (AgentTesla)", "value": "bb11c4bba1de99384cad1141f9200419e9a36b6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624289171, "uuid": "be5d9782-e02d-4343-b931-9bf1db5d67bf", "comment": "Malware payload (AgentTesla)", "value": "0d65ba70ce985168a8ec4a111d1410ca88079a9a5be0a25898131f4dd9d5a52f8d058622f9605fb81ec3372c67680857", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624289171, "uuid": "9f40fb20-a638-4abf-8533-e564e073df3d", "value": "7DF2F7AB6051B514D6E308742CA1FC743B68A7319990D10EE072995CCF82BFB78ED9DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624289171, "uuid": "e22478e1-5ae6-4c26-890f-59554bbad4a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624289171, "uuid": "4afc629b-9dd5-44b1-9248-8d9f2b8acb07", "value": "768:ps8dVGSl0lksBY7FlSs914hT5jJMklhqS:pRPZl0lPCzjT4PjJV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624289171, "uuid": "ce1f76d1-d673-4d92-8c8c-02d9895a2e50", "value": 35480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624289171, "uuid": "9cd23f07-00c9-4a1d-9d55-0782440a0a7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624289171, "uuid": "96665477-fe1f-49f7-8ab0-6e57e499e3e4", "value": "Specification-Fabric81477.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4a8054-d25a-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624257382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257382, "uuid": "4e2eb6b3-89bf-488e-bdf2-d0daf7d155c3", "comment": "Malware payload (NanoCore)", "value": "d41947402ed8846aa75250d27b62054c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257382, "uuid": "889097b3-2de9-4e13-945d-014fee4e90ad", "comment": "Malware payload (NanoCore)", "value": "63d5ecb47e7138d0a0d0c401513b9e4cc0f47f94786a904ed6e65bea4cc8eb10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257382, "uuid": "c9788f2e-1953-4f32-9089-285ac07625ef", "comment": "Malware payload (NanoCore)", "value": "c68325c8bc0a9e68f3fa294fd6f332a0f3726fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257382, "uuid": "d7a252ee-c988-47cb-baff-2caae161b717", "comment": "Malware payload (NanoCore)", "value": "c89389f3cf93ad97177c3e9bd4ec710dacb5bd12cf060a7ccb7761b3a2d371d05c760ab775be20fa92432cfabe3e221f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257382, "uuid": "b9d19912-241d-4665-bbc3-97ac9ae75404", "value": "3BF4CF3039EE510DF577AF781AE436E29A7FBE577707996C24D4234A87238028F81939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257382, "uuid": "b001d026-5e20-4abb-87dd-0dfc3fedcfd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257382, "uuid": "efb820d2-2dec-4cba-931e-627f5ed0e4e4", "value": "12288:C9b5gWFHmsmSwRPbbbuPg4cOn2mysSw9rqmmYnlnHvrOs3HhU:CbjHQyLnDlvLPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257382, "uuid": "5407d528-7d32-49ef-b25d-3b9f33dce5b2", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257382, "uuid": "2448625b-f33f-4163-b283-01ba377045b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257382, "uuid": "d537c4a5-cf82-4b17-b200-6422cfc31559", "value": "27bd034c36964c455e2b2ad6b264561f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d8ac0e-d28e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624279668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279668, "uuid": "3fe2b316-98fa-4d72-8706-00b3bde46425", "comment": "Malware payload", "value": "f2d23b31f5297c4ba3a37d8e26fcf4f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279668, "uuid": "343abbf9-b238-48ad-85ba-7454b740ea49", "comment": "Malware payload", "value": "640afe066f2c06ab89200a7d74527657290f45899ce8f97b88890ea3bbb13f1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279668, "uuid": "c687bed1-5ed0-4585-b3f5-09045ff8fa28", "comment": "Malware payload", "value": "67e1922f1acf38bcbc2da883c254eec99a2b7777", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279668, "uuid": "d06a8412-b220-40e9-a74e-a5e710d5535e", "comment": "Malware payload", "value": "ca1e4d052c19f745c9a3ac08e5a4b58f3603b9d00290ef0cc035c52212d6f67e823f5db6cb4c174cdc76836af68ed693", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279668, "uuid": "5f2709a5-2ad1-4917-bd63-0a9620759f5b", "value": "F0066D12B3AC657ED09B2B7B58B79654A93F7B7129118C4A37FC084CCF35E40293A627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279668, "uuid": "97fba075-e524-4761-87c6-30b01315c9d5", "value": "57c2f561fb6d639edd926e422210747e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279668, "uuid": "a2a76112-91fd-437c-a2e4-1f60294d9844", "value": "49152:T0BpSKt0Cm6UrsSOiaB8SndgkyH5r7J5iRJT/F01PvBM4:Topv1JgkIr7J8vq3a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624279668, "uuid": "19f83fea-bdda-46f2-8af4-077a1cf5a732", "value": 3683040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624279668, "uuid": "280c562e-3ed8-49c1-bdde-861df27f5366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279668, "uuid": "4f1628fe-ca30-43f5-b4bd-9e5097edda13", "value": "f2d23b31f5297c4ba3a37d8e26fcf4f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0026f26-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624258968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258968, "uuid": "dbbf121c-e2d9-4ed2-acb4-523a09b2f1b2", "comment": "Malware payload", "value": "044dddee4308c73a3d6d7cb710f209d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258968, "uuid": "261adfb2-527f-4d59-820f-bf8e5ff9c250", "comment": "Malware payload", "value": "6495e9cc59844c804022b026aff88b0afaaafe6a23702231eaee3e1d74d448ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258968, "uuid": "5e83022a-6f65-4771-a6be-facc8dceaccc", "comment": "Malware payload", "value": "875f991fb85660b34f738d76da5a28e3c26ff62b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258968, "uuid": "7e646715-b0a7-4068-81da-bb9b6e229ae0", "comment": "Malware payload", "value": "2ef103f0b1927fc963402c2bf07b96835833a2f4ca725e7e102de66bee2fa5d03ca411517af8b9b8d9641abea360a0e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258968, "uuid": "8905df58-aaf2-45ce-972e-efaad3382ca4", "value": "C466335539F086BEE1610030ACF63D85B335DD184EB4E5632B2D163F9F7C9893A3A52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258968, "uuid": "ac4c0ee7-8ebf-4ff0-89fd-12938f1ec9d2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258968, "uuid": "2b19f163-c8cd-41b2-aaa2-42b403015915", "value": "98304:e1OBSfk8bUKAB/mHhqUQ5MJmtGBRUMXMyZHG+r8wSKcwqMhBSFa:e1OBMk8FAfNmXxBZmbx9wqMKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258968, "uuid": "fe60e56f-b172-407d-9825-3e2e96237cd1", "value": 6518984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258968, "uuid": "517998b3-6239-4ecb-a7a4-771397113e82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258968, "uuid": "7c53d11a-2f6b-432a-b103-92e5d16ed4de", "value": "044dddee4308c73a3d6d7cb710f209d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583a2aea-d25b-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624257532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257532, "uuid": "a3f61a78-7893-440f-8b93-44040d4f35c0", "comment": "Malware payload (RemcosRAT)", "value": "0228fb66019eda727dd89ff9ed08495f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257532, "uuid": "782b7932-1193-4330-b4ff-4ccd654cf3b6", "comment": "Malware payload (RemcosRAT)", "value": "65fde50589aeecb442c71375f93907321b221ca9390b96058d9d738cd2c3a66d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257532, "uuid": "a0f4b0cd-0792-4372-a7c0-f5004829da08", "comment": "Malware payload (RemcosRAT)", "value": "19b5b485900a51a23e7c708100809ef161a84dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257532, "uuid": "f1a5b817-598c-4c83-83ad-c8bc14d36896", "comment": "Malware payload (RemcosRAT)", "value": "a98d46ade8c2d4902b441237316270b67de8348bc93f3f2f7d0ef73f8c5707e61abb5a3a449472f0c35f4a77dd5c2f8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257532, "uuid": "9b25da50-92bd-4cf2-9c28-9f600adfb988", "value": "CC157D69B6409876E87337F84C8A9365253A3E117A24BC4E2BF93D4D3F74250393E19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257532, "uuid": "02093197-a25c-4b2b-86f9-30d9655266b1", "value": "c042d6518b15edc22ec37a43d14138bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257532, "uuid": "56b8d1b6-0c1d-4aa0-b33f-1a8f46f8cb02", "value": "24576:CX2aUAKvTWIBwUo49MYa4HvjBT5q/XQBoG:CX5tsddGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257532, "uuid": "5e99f5a3-579b-418b-9dc0-46dcfa0dee9b", "value": 927072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257532, "uuid": "c08d7c70-e1de-4b62-acb1-6458683cc017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257532, "uuid": "13f97e6f-b239-4b4c-a669-362942ae98ac", "value": "Urgent Contract Order GH7856648,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebddbd3-d25b-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624257678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257678, "uuid": "20c1a045-b9d0-4f5c-a397-a2ad6f71a6a0", "comment": "Malware payload (RemcosRAT)", "value": "338ffcaf3397eb562228788f41c0268a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257678, "uuid": "0dad566d-b54f-4104-a781-259248f9bdb9", "comment": "Malware payload (RemcosRAT)", "value": "6654c75acd136f37aad63d828eea396361326bb422a91563998ff0302de2bd20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257678, "uuid": "907191f7-20af-4f4b-a751-1abd3dd8fa4f", "comment": "Malware payload (RemcosRAT)", "value": "544a8b8d98775ebfd452651cfc62bc1495d33488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257678, "uuid": "558e4b7b-65ff-4e22-9d1b-567315404e6b", "comment": "Malware payload (RemcosRAT)", "value": "1473a8734464219a2d2fd0bb5297fe59353956a8ff520973fc90506aa5f7de06383f2173784eae61ba41998ef8ee58be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257678, "uuid": "5eb03cea-e576-4c19-ad48-5b7f635a091e", "value": "6EF2086AA0513258E6E349742C21ED743B68A7755C80D10EF422465CCF83AFBB8EDDDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257678, "uuid": "8652587c-447d-4e8f-bc5b-c4ea6ab0eeb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257678, "uuid": "ea08d17d-4792-48a7-b8ed-93d20ad23d8e", "value": "768://8bEpa9Yvp4kfMU/RwEeQT3YkPn4X5iThB:/kbwa9YvpFx/RwgTL/4Xc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257678, "uuid": "c42b368a-8077-4f5f-bb4b-cef12ecaaeff", "value": 36520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257678, "uuid": "9d804d9a-44c8-49bc-9455-9b2534cdd285", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257678, "uuid": "c65af2b3-5747-4d47-8b9b-d3a4016922d7", "value": "W0rld cupQATAR 2022 STADIUM PROJECT ONGOING .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcf1d2c-d24d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624251774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251774, "uuid": "f7ca123b-a133-44e4-97a6-7973d1e57d47", "comment": "Malware payload (Formbook)", "value": "d59f82dcd426fe19fa03336cbe13a6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251774, "uuid": "ea379210-cd05-4ff4-9c6c-a4db655af1be", "comment": "Malware payload (Formbook)", "value": "66b02d69d4eff510190fb38504be6dcf9f94d28f14b0569c7d1cd36bfb78983d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251774, "uuid": "6d8e04b8-79c9-41c8-8e04-dfafcecd99a8", "comment": "Malware payload (Formbook)", "value": "a973eec6e0ead9558a5fba6193468a70bcdb1108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251774, "uuid": "ac21a49e-0da5-428b-b457-e70a464e5093", "comment": "Malware payload (Formbook)", "value": "0d71eedd4d9f447576c7f1bf99271e3a8759edc9b90f9e12ad8b0e309f32d6bac8838bf3b82ec9c8a1bdc11765f29d0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251774, "uuid": "851378a9-d2ff-4e19-b145-01a23ddb7ff5", "value": "22F4BF3039AEA10DF577AF741AE436E29A6FBE637707D95C14D4234A8B23842CF41939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251774, "uuid": "efb67a70-e229-48f3-947f-3b5eef40eac9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251774, "uuid": "9aabea36-86f2-4887-8127-bc85a8e92321", "value": "12288:qGYXQWFHmssO2eB56c3fBKuXguhioKIlkzM/XHPSo2ZnOElHhU:qjTHuU6cPBKuQuYoKI2zwXHPJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624251774, "uuid": "45d6234c-77aa-4839-86e0-67f61e2b18a4", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624251774, "uuid": "837c78f3-5333-4f5c-832b-76bf1c222147", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251774, "uuid": "33689f5c-9e24-43f1-aa1d-50ccb04fb185", "value": "INVOICE E-4137 REV.1 AND E-4136 REV.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471b8074-d28c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624278549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278549, "uuid": "b8c72e53-8ecf-4a14-91b1-4463050be949", "comment": "Malware payload (GuLoader)", "value": "e7ba8da6f0c9e95ca83b0529b62dae75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278549, "uuid": "a0298177-8726-4a62-be5c-3a1791c58ca2", "comment": "Malware payload (GuLoader)", "value": "6785bb7e30144c967cf7c9c905f2bbae99951ac320d5d30d63e11a30242d3547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278549, "uuid": "374a3968-3069-458f-b8ea-1ba342f4ef05", "comment": "Malware payload (GuLoader)", "value": "92c387f6effbe2df74b601b98f57cad2a6a51efd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278549, "uuid": "c5202435-d86f-420e-922d-60155fa0f12d", "comment": "Malware payload (GuLoader)", "value": "421ea1eb3715d2ec8fd02079b40444d2a4eacd7f2d931b602419cbe0f2b22d00ae1bd12cd0b4e7dcdb26c1b0934c2afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278549, "uuid": "b817f12b-e9e9-4493-a9a4-1287d3532cd4", "value": "2B147CB0B781FD72D76A857563914BBA1E886C304958C9C3E2C1331FEBB66D2C731626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278549, "uuid": "bda529b5-9aed-4036-8a69-7afc5166495e", "value": "269fbb82c8f402e670c866cdbdfbba84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278549, "uuid": "d3f02794-2fb6-46d6-8a60-a60e8a8adcb3", "value": "3072:x2cPWryIMoLVaqAd581PdodzGieLklBUTi4i22R:IUSRaqOigdzGi1lBUMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278549, "uuid": "90e9282e-5fef-4b65-a058-d944f5244905", "value": 193648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278549, "uuid": "221d66e4-294d-42ce-9380-ea707f0c60fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278549, "uuid": "627fd32e-2164-4c4c-b1d0-9dec4b4b7809", "value": "COPY-BLAZON.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b65deb-d29f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624286806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286806, "uuid": "19176887-f28a-42e9-8a6b-f63ee1ea8cdc", "comment": "Malware payload (Formbook)", "value": "c2f8614d05df1b55f07d2d9626cdc045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286806, "uuid": "bde83f4d-8738-4d8d-a27a-5adbb44a76f8", "comment": "Malware payload (Formbook)", "value": "680d4609ded638e617b9f1a00fe9dcf69b6e505f617182961b8492dfb95d5347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286806, "uuid": "1abf17c0-f3ca-4768-abb8-d36def98ef48", "comment": "Malware payload (Formbook)", "value": "1e347885201e85b6acf14d8f6862a0aa6ffacb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624286806, "uuid": "953cb2b6-1bd2-4d96-bacc-c9840afc2d0c", "comment": "Malware payload (Formbook)", "value": "08a0a7a989bf44b3bb938539b3fb9b89660723726c856d59f7f45058bb31c53782bd01dff016a2e57d9be9b7179fcd30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286806, "uuid": "0da05096-0e0a-4604-8a91-04bdef439bb9", "value": "9735BE220ECF436DE2754FB517B0BC8782B6ADAA3705A2153DC031ADCA335D9D9EE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286806, "uuid": "d5c94a88-8b59-49e6-bce6-ff17c4e07264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286806, "uuid": "08844cae-e13b-4f26-96b1-b49e400331a0", "value": "24576:VEHHip1ulNGMsNYoTYKHog4tcmmiBmcbrH:aHAuzGbNYY4i/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624286806, "uuid": "f05ce9bb-efc6-4f61-bb7d-e624daf22cfc", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624286806, "uuid": "833af89a-7505-4d82-957c-23005f65f504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624286806, "uuid": "f8b55c4e-3110-4ff4-97e5-e1afb978c0cc", "value": "Statement for MCF and SSL890935672002937383920028202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780f905c-d2bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624299247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299247, "uuid": "54434054-8648-4f5d-be28-010066dd5214", "comment": "Malware payload (Mirai)", "value": "1f18d79fa0f7d5e1db1cca0d43a98f79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299247, "uuid": "f1aef62e-4336-41ad-a49a-f1e69b675f94", "comment": "Malware payload (Mirai)", "value": "6830240765191d51ffff9d703e57d8e7ea0e20426d4f3c378dcc0c2c7d51a1e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299247, "uuid": "a8576e04-1b19-4c38-874e-3061d13d742b", "comment": "Malware payload (Mirai)", "value": "a228f3edbb39d5f1385a8feea43d69e988afe44b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299247, "uuid": "1310dec6-a358-4547-9938-50e42ec3bfd8", "comment": "Malware payload (Mirai)", "value": "aadf83ddf550361739686c80bf4eca1a6e1ea16f1dc225ce575862966c4d2f89d3659204698e2bc62809ebe31d50e5a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299247, "uuid": "274d9349-ecc0-431d-b3bb-25ead0fad495", "value": "AEB2D11AC09E2EB4FEDB7D356941E2827B615BDF7A61CDC01AC15B110722D281FDC6D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299247, "uuid": "abdf1ef6-4f0c-44fb-9103-681773de18fd", "value": "384:2A0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoJOM4uVcqgw05VxJf:oApCdvwJr69VJoA8FZtxCo8q4uVcqgwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624299247, "uuid": "4876409d-2740-4cd6-82b4-7c8872695713", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624299247, "uuid": "139f290f-5877-47d0-9966-7bf603b68653", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299247, "uuid": "ad56549b-280f-4c00-b98f-ec2f151769b8", "value": "1f18d79fa0f7d5e1db1cca0d43a98f79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac3669e-d285-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624275468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275468, "uuid": "c4321ea5-dfdb-413b-a0ad-6faaea06ab21", "comment": "Malware payload (AgentTesla)", "value": "93e33a30fb96a28f4a8c3ba59b5cd79e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275468, "uuid": "6a1a8f55-dd34-4caa-9632-5b1a7038ae40", "comment": "Malware payload (AgentTesla)", "value": "68aec1a339916ce3f290fc98d0e99af44a9607ca03114c5e3857cab7acf2da41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275468, "uuid": "6704d08d-b1d8-4d8e-b04f-0724d2dba7a6", "comment": "Malware payload (AgentTesla)", "value": "82fb629d9ccbfbb14ad5d2dc1ebeef093329faef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275468, "uuid": "b1b28889-2cf8-498c-bde0-9862429abda6", "comment": "Malware payload (AgentTesla)", "value": "916dd73de849b436fdd3f04268b1803d6fc51dc65046d5cad44583c8d25c6118b7b83ac51299dd57c1a37090fde7aed0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275468, "uuid": "41c8296c-e490-4749-bdc8-25f3ea038558", "value": "3DF4CF2039EE611DE5779F781AE436E2967BBE637B07DD5C24D4234A8B23842CF41938", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275468, "uuid": "e3b22cca-8d6c-42a7-b856-6a14652ae46e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275468, "uuid": "0a247c0e-e900-4489-b40b-0482ca283e4b", "value": "12288:Dnv/xTcWFHmsmNY9Y+EzPLJD/6yljGeX6Qh9c2eSS0EPXLz5JbHhU:DvZ3HcNKjEh5jGlQPhfSXXLz5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624275468, "uuid": "60f0e3af-de69-4dcd-b146-92d5af3e09fd", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624275468, "uuid": "10c04806-aade-48b7-9b5b-0e5acf926c6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275468, "uuid": "ca11896c-1713-41d0-96fc-0e19cb9bdbc5", "value": "INQUIRY-1484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4761fe-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315036, "uuid": "9f08f8f6-b5a4-4757-946d-7038afdd6694", "comment": "Malware payload", "value": "bc749e6b2085432328931dbf79012c7d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315036, "uuid": "9c31f4fd-b321-4bf2-8d20-6b8f4f92767b", "comment": "Malware payload", "value": "68b256f472efe145aab3a373cdf45265bd1de06eb61a9ca18afd6c0e46e8b51c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315036, "uuid": "30b55779-1d33-4a0e-bc94-923c6224adc3", "comment": "Malware payload", "value": "dc1876b1311c59a6bc6c17147ce4ffc786496f07", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315036, "uuid": "6cdafa48-df3d-43a8-afc2-1e4a0b947200", "comment": "Malware payload", "value": "947a507879c8043afe9b2828fd3664d1eff6107fa8345ce51245e5ffdeacf4d7dcb827beb51e5def0c34798bae70d904", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315036, "uuid": "bcd1cabc-a1cd-45e6-915f-3ab9295f6f70", "value": "9C04D01FEAD706CDE337AA333A5D732B62C45612DF19D0A8CE14D2FBC1B14904681A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315036, "uuid": "4bf27b65-af00-4413-9a7b-153a5ef789f9", "value": "b380277cbb8ae5571489cb34552d83fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315036, "uuid": "4e5ada75-0b80-4070-a19b-954f11e680b5", "value": "3072:AuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:szWxkOP4p2EesvcDi6DOHPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315036, "uuid": "a605e39c-e61c-486a-a8e7-b527b64db22f", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315036, "uuid": "6f4c326a-9985-4552-9636-8b9e5fbeff53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315036, "uuid": "eae12778-6692-4268-aca2-43b9531dab63", "value": "5I6Aat2cPWN", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bc30eb-d2a1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624287813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287813, "uuid": "77eef4e2-7011-45a1-b042-a877a8a53fab", "comment": "Malware payload", "value": "38f542316153f12fbab8fd7ae4f35923", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287813, "uuid": "fb8a390d-473c-4aad-9306-54ddb4fe608f", "comment": "Malware payload", "value": "69daa68bc09f5594446d33c266700617ccc02faa293f0420bb7e209db1096086", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287813, "uuid": "317bd49c-5428-4ce8-9542-af2065e32e47", "comment": "Malware payload", "value": "39b1c37866c2fa30230bd70157ccef89e388ab7a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287813, "uuid": "845e8004-9f43-44bb-8115-3e31a2acafa8", "comment": "Malware payload", "value": "815009799a10a833bf01025e47290f953234524109385d1f020c3388e8f6f9a41d88d98ba1ca5266e89731e393a1cb16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287813, "uuid": "e3581177-fdae-47c5-83f2-21151da6cb43", "value": "5BE2E11D88B68F95D7758AF7058BCD1C8EEF93B5FD246DE186612EC4037A10FA459308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287813, "uuid": "82c44790-2631-48f2-9899-fd1f8f3be020", "value": "768:win4W+m7jnflBAu/1ja/0tEkVeTp2HP3Xd/EcJd+srFGHnxndJxBZFM:EWTXdmu/5k063Y98cJHZGHddLBZFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287813, "uuid": "e708cf15-3194-426a-84cd-3cb0bfa1627a", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287813, "uuid": "b7c9a116-0d0e-48fb-a01c-080172d1fe12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287813, "uuid": "9ba15ece-4587-4a8e-b26b-9c403c387753", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fd9e75-d2d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624311078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311078, "uuid": "b551a56f-00d1-41c2-a7fa-a8ba802740e5", "comment": "Malware payload (Mirai)", "value": "ef5d7ad161392ae96852ae474096cf7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311078, "uuid": "68aab69a-0085-4172-85a0-54f2557727e9", "comment": "Malware payload (Mirai)", "value": "6a63b0b0c8cce3d377aac103beb2e4d6640a78384fb283de980681704d2068c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311078, "uuid": "242268ab-9ac3-4009-b45f-a879dd43c95a", "comment": "Malware payload (Mirai)", "value": "0c1d41475e835df05234425e6e456d5067ef199d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311078, "uuid": "e3c7da07-2f5c-440b-8ed4-010c0b7b35b0", "comment": "Malware payload (Mirai)", "value": "895d9fc9c06ed134b3a3771f2f33091af55fd24d321f3509e07ce71fad962391b66780ae0f0b5f3762fd8c39d555b8d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311078, "uuid": "7bcf82bc-1a05-4549-bddd-aad654d3b264", "value": "AA333BC1A743DEF1EC1206B53077EB338B77E47A212AF9C7E7D5A527A845A01920329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311078, "uuid": "75054483-c50d-466f-84a0-52e7646b39bb", "value": "1536:s8OP6OftfvJfrJf0hJeVVMA3Zv78slC8KOkYcPnYrTGGgvIw:hOfVxfrJfAJ2VtpwslC8KOkRnYrqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624311078, "uuid": "928205b7-0e3e-43fd-b01e-414b5dc9eff9", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624311078, "uuid": "5214067f-aa23-4b3c-a803-a5da04bb9ba0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311078, "uuid": "2bcdd04a-20ea-4782-86bd-3f9f626b887c", "value": "ef5d7ad161392ae96852ae474096cf7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc8a8e1-d297-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624283174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283174, "uuid": "53bb85e6-601a-41d9-8a80-c3f0150ea99d", "comment": "Malware payload (NanoCore)", "value": "c9b0fc79fe1a1b913331f654b9b6b393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283174, "uuid": "6409894a-a63a-4d11-8810-3f40681b73f2", "comment": "Malware payload (NanoCore)", "value": "6aa6638b100f86f37f7a3ec23f54c997d575de9af7b8641c203b9c0ee8f18eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283174, "uuid": "2c762153-0b09-41ae-8ff5-fbf9f91d4577", "comment": "Malware payload (NanoCore)", "value": "e29b32f3262686fbe5473412110fad0389859334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283174, "uuid": "0da8be5a-069d-4826-aeed-e19b2c18b83b", "comment": "Malware payload (NanoCore)", "value": "408614174db00860e60178f8514b5a5f75e54f94bd38d075fe195ee42b864c6058385fab47b0b0a3fda2d372a5715f10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283174, "uuid": "c6dbbaf1-1760-4b42-8099-92bb77a0e736", "value": "62C4012437F95235E6BF9BB829F57104577AB1333222E20D8A9120C91BA3F51CD52BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283174, "uuid": "c7df1af2-d6ae-4959-b438-1b2be48c96d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283174, "uuid": "b65fe7a0-e72c-4cfa-afcd-5cbd24327c26", "value": "12288:BhVYnQJCSe/+o3s5JKAbSkC/Ns+5AENQvshEKNEp:BNJXeGo3MJNbTuNs+5AENBJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624283174, "uuid": "c62dc02d-b393-41fb-bed3-f17bd6ed3091", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624283174, "uuid": "98bebd9d-54d9-4cf0-a14b-adc85a1b888c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283174, "uuid": "c972b61d-3692-4135-8908-8863cd881fec", "value": "POP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef45460-d251-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624253410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253410, "uuid": "db44f31d-75ad-4625-b67f-4435755d081d", "comment": "Malware payload (AgentTesla)", "value": "725c40d8e662beef5d3e66ff02b4967a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253410, "uuid": "bdf3f650-e591-41d2-88d3-9d87f267fd94", "comment": "Malware payload (AgentTesla)", "value": "6b06b6f35219bbd40023042b90b7c30d5a6371169328128aeea3c3f9d57c84fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253410, "uuid": "b2d78a7c-0286-40e3-a1bc-5774cc59fa0e", "comment": "Malware payload (AgentTesla)", "value": "149cc0b2cdd6d53e0fd471bc8f471108a0310645", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253410, "uuid": "277bf396-bf3d-47b4-b093-a9dc56ed3d9f", "comment": "Malware payload (AgentTesla)", "value": "7a5eec49757fde76c5d3fa3201617221508ec7c8850752bafff6a8bb9283046987cbb5f95b912e28075dc9fa25d8ad97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253410, "uuid": "fd4c4139-2635-4e16-97bb-59e59906295f", "value": "E9E4CF203AEE6129F177EF795AE075869BAFF7233707D45D2891038B0A13A81CDD153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253410, "uuid": "dd97e2ed-86ab-45c3-b6c8-eea74ea4ab75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253410, "uuid": "27cc51a3-5f8b-4b1c-b732-ffe604c1cd67", "value": "12288:YTYchlm4S4F3M9yNm2iN13zOUHQT6pC5ljzVrGkWHQkc0XXRO3Jc1:YnWh1D3v46oPjNou8XRO3Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624253410, "uuid": "a05c3008-175b-4ae0-b2f6-c8ecbd8b016a", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624253410, "uuid": "f26a15c7-6a9a-4a3e-9491-9caa651ae42c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253410, "uuid": "1a2cae6f-40e9-4dc6-b4f6-61d979a49201", "value": "invoice copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d68afd-d286-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624275993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275993, "uuid": "0d467a7a-aca8-4a28-8fbd-ac147001fa0e", "comment": "Malware payload (Formbook)", "value": "450b3982bf31663bc7f9c04dc480d5fd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275993, "uuid": "52ab7062-d16d-43a1-91e5-ca82683dfdad", "comment": "Malware payload (Formbook)", "value": "6bc786d07a7934cffeb69fb03c63917a640562e606d1db3660a416f98561f6b8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275993, "uuid": "aee5f085-5910-403c-b478-24b3dc89c83e", "comment": "Malware payload (Formbook)", "value": "9304475e8ea1f6e0675b021110274d30ac83e245", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275993, "uuid": "c23b2f84-c5ba-4af9-a226-c7397dada77e", "comment": "Malware payload (Formbook)", "value": "4ebc96aa01d34a995aff4e1e0ec7417f42a5a0bdd44180df05f888431b625a19496cf69d7729d10535e31ea47fdd87ce", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275993, "uuid": "2e4581c2-09df-4223-9c62-d667e6e161e0", "value": "A595AC0CA0BB5A52D3CBD5E0B6AFB30C566DB84D21C804594825C5ED7CE4CE9C7A9CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275993, "uuid": "ff311d92-e7af-46ff-b011-002453bb16d7", "value": "1536:WNF7IFXxUUUUUUUUUkLUUuUdLNxBrt14OUdoQHFraQdLNxBrt14OUUUBUEUUUdo3:7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624275993, "uuid": "dd0ae9b6-820c-421a-b796-ec23e47ffc46", "value": 1910278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624275993, "uuid": "b1fdfdad-531d-4438-8b25-1c6139da6fac", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275993, "uuid": "41c74461-b558-49dc-b6ff-667ebb740255", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.19092.24537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d082b14e-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624259023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259023, "uuid": "bee90522-17c6-4a09-9e56-fbc268ce006d", "comment": "Malware payload (RedLineStealer)", "value": "50196f98b4f41bf78043d64274a4cc45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259023, "uuid": "830f2a17-ee9c-47ab-b662-9eab9a174baf", "comment": "Malware payload (RedLineStealer)", "value": "6bdc604eae27b29cb103a130734a0bbef2d7f36d53d5a5f1b9458935e49b6326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259023, "uuid": "4eaa21ba-74ed-4b8e-a216-4100c6296cd0", "comment": "Malware payload (RedLineStealer)", "value": "cfd4ebf419373f78a880d815c1ed5af8b256eca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259023, "uuid": "fd285f4e-5021-4587-8a2e-2acf9873b794", "comment": "Malware payload (RedLineStealer)", "value": "932516fbd88f4c03e971a1cd4d6c7cc1b84ed5ea9c8d289e62502e8914d238c072e2f3af0a5ab7afe8413ca02da03056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259023, "uuid": "f666c4df-2f1c-4ce5-9534-967a8481295b", "value": "8DE4E110B692C035F6F722F8557583ACA92E7AB1977861CF62E11AEE1A347E0DC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259023, "uuid": "80b3c483-db82-4dd5-8eb4-2ebc4c6507b5", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259023, "uuid": "49fbbd15-2508-499d-a25f-508321634e26", "value": "12288:sbCaBBp+E9i1RC88x2b1DPwrQ2V4F3zmMIDZ/C+Ok8KmzGPMFVJbggtnlC:TQBp+E92nBwrDQzmMId9V10Igtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259023, "uuid": "9e384534-5f3a-48c3-b6be-278fdd8de8b4", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259023, "uuid": "9a982d6f-298a-4877-977f-e9b18040eb5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259023, "uuid": "f7068c02-e1e8-459b-93ba-efcff4a3d585", "value": "50196f98b4f41bf78043d64274a4cc45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8faa5a04-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258914, "uuid": "738f791f-a0ed-48d5-bfcc-ffebfa2c0edb", "comment": "Malware payload (RedLineStealer)", "value": "1e23a46ea14f9089fa9088d0ac6e629d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258914, "uuid": "ea58b0fd-d4ab-4670-9a0f-7218dc6c391a", "comment": "Malware payload (RedLineStealer)", "value": "6c1b17e5d8fb103a8a0fffa08a6f25ef2ec3cc414491159b00342c6dea9ca47f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258914, "uuid": "9bc65738-1310-4ecb-a262-828271740454", "comment": "Malware payload (RedLineStealer)", "value": "23acd15488e805fea6495f151c80c261d9f727f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258914, "uuid": "8fa5d741-8be0-4c03-99ae-946b8f96af93", "comment": "Malware payload (RedLineStealer)", "value": "2c13ff086eb4f437ff91937f16b3eeaca7bb77acee6e3f70d1f51ad7fe0a2aa248322c862e16f6cf90ea8c0ed1c08061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258914, "uuid": "63e03a54-fc4d-444d-9d30-d5ae7169eaaf", "value": "A3E4F110B6E2C035F2F751F4597A9378A93E7EA15B28A0CF12D516EE16787E4AC32313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258914, "uuid": "564ba107-e90f-4fa2-88e6-333ebc5215bc", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258914, "uuid": "445c7bd2-8c7d-4e6f-9e37-324fc4497848", "value": "12288:lCBQ3BVOs2pa+K22hqgMm/+l4cnli7yMVYgRNSkg1aspKyxrQLAaPhL0OGlZ:lx3BVOsBvqw/24cnl1MVYAobcIKCrGPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258914, "uuid": "9972a1b9-cf30-4462-9153-f930a73b6513", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258914, "uuid": "a9ca5c30-2568-4062-b70d-2af70463310a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258914, "uuid": "96f50964-e984-4aca-8f9b-7abb5c2a5047", "value": "1e23a46ea14f9089fa9088d0ac6e629d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d253ad-d22a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624236372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624236372, "uuid": "1f15c85a-c62f-4b5c-8700-2666f31796b0", "comment": "Malware payload", "value": "88f2cada2e0243ba55d434a87a204265", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624236372, "uuid": "f8df5034-0108-41fd-9dd7-e3c90b46a536", "comment": "Malware payload", "value": "6d4e6d54d7fb566e6887ce79f7d65c151b3092260cc7fef21dc60d46a265b4ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624236372, "uuid": "698def85-932c-412c-a37e-705a2c7dbe47", "comment": "Malware payload", "value": "7ca8b579078e01f561ca8a1b5879c1380d220737", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624236372, "uuid": "2d57d0bd-bce6-4760-bea7-a88bb3433240", "comment": "Malware payload", "value": "b96904462515e8190667a708d746a348f35fa7e4a71149b891a546b903666c7a099225099392a8c83794bfe4d7f37f75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624236372, "uuid": "3ec4118b-3322-40c8-9f18-ce87fb960b9f", "value": "50350210B6A0C036F5B362F4497A83696A3E7EE197B554CF12D51AEE5A387E0EC31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624236372, "uuid": "d2b8249e-4a18-4cd8-aa19-ec92e7aec9c4", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624236372, "uuid": "85b86554-6a05-45f0-9b72-8e63ac68dfba", "value": "24576:GJnTpomf6d+JNVu0r8oMTdbyQdRIZnCBM1s:Ef6d+JN/ookdby8aCBM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624236372, "uuid": "3e513fb9-7c7d-4987-ab83-40f5569c16ba", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624236372, "uuid": "506f5965-ea58-4e02-b914-b7b58ae49d9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624236372, "uuid": "66455b5e-8268-4397-ac9f-7050fb287d7b", "value": "88f2cada2e0243ba55d434a87a204265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4167df2a-d233-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624240314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240314, "uuid": "38be8478-d686-40c9-8066-62f992a93ab6", "comment": "Malware payload (Mirai)", "value": "0a4d6929d6f18450c001d53c03949749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240314, "uuid": "5a3355e4-417d-410e-bdff-39a1619feaea", "comment": "Malware payload (Mirai)", "value": "6da6e476e24b588f7f8c6e47a1dfe6b542445afe2a2f566d7fc9e1d3bf6f969d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240314, "uuid": "35c94dcb-f017-468f-9dd2-3a3f48567b23", "comment": "Malware payload (Mirai)", "value": "2ab9939842c1ebf4f13c762b961e5128fc146f67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240314, "uuid": "58861d35-e332-4a76-aa6f-daadde2aef39", "comment": "Malware payload (Mirai)", "value": "75975db4c4ac81b56ccc716b25a8ca799d331a18c15abf0f1d5c7e5d45eb224995bc0109b6d9cf30764c17ff323a59e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240314, "uuid": "589c49d5-2a56-4c1f-a300-365cc77a0981", "value": "69E35C47AA515FB7C2496BB169F75A300797E4640F0B1F8975389AF8120F6CEB80FB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240314, "uuid": "e07185f4-f6e5-4fa9-9c24-9df27f449634", "value": "3072:+/JkbIVKFXFSUAa8wXSy9uHfCu1T8gJSxW6Vypwl4yAB:+xGj7ewXl9+ChxW6Vypwl4yAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624240314, "uuid": "7b32eb00-5f07-4a34-a0ef-c4f698341e50", "value": 144382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624240314, "uuid": "8b137566-a171-48a5-8497-c2322e817024", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240314, "uuid": "7a2b8d76-a369-486d-b541-918acbcffc00", "value": "0a4d6929d6f18450c001d53c03949749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b5dcff-d231-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624239684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239684, "uuid": "6a7aa8a8-6a23-4c9a-8c84-013865cad4c6", "comment": "Malware payload (Gafgyt)", "value": "1593e33b6a8e6baf1138aa387f20860d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239684, "uuid": "649e0ce0-7e7a-4507-8491-7feee56d47aa", "comment": "Malware payload (Gafgyt)", "value": "6db4adc8e01bb7857b4e049f0af47aa6ee81429312c2d5ba8e4f843da6ce9e10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239684, "uuid": "f770de0a-5d57-436a-a881-03942b8ddcf0", "comment": "Malware payload (Gafgyt)", "value": "bcc33bef093d66ac8ed2f26d9c88f3ed03ac4483", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239684, "uuid": "44730454-f724-4aab-9fa8-cb3667a7628e", "comment": "Malware payload (Gafgyt)", "value": "3da9b7d3669f9cc93fd49c8c00f14f1a217631417c6b901bc4ce52e7a4e7366283bb57d3c0a8fed86aedce7ede41e86e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239684, "uuid": "ba298089-75df-43bb-b968-6baf2f36e1c5", "value": "62A32996B900EFB6F40EE77604D34B247270FFA25E93163273177966AE362D42826F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239684, "uuid": "403b367d-49b5-49ac-a576-3bc8bff8e215", "value": "3072:dDbnrqYQ1FsAqbce0yA+Vzxmm/Npbxs1n6KNH:deYYFsAnyAuzxmm/Npbxs1n6KNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239684, "uuid": "f0c0d4e7-4f98-4546-b59a-150d8af55996", "value": 101549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239684, "uuid": "ea87b719-299a-444e-9c54-a68f1e67eea2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239684, "uuid": "9e963a49-dc72-470c-8268-01b7902372b4", "value": "1593e33b6a8e6baf1138aa387f20860d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eeb8460-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303124, "uuid": "b41caeb8-dae9-4181-8c09-1dc6db7920d6", "comment": "Malware payload", "value": "d32f8902039d60bc59cdb0cfcd3507dd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303124, "uuid": "a97c67f0-8c50-4b9e-8581-71d9d71560c9", "comment": "Malware payload", "value": "6f220dc3acbb8c5f77b0cab2ea5708768f631487f3df4f1f19b7801b6beb16ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303124, "uuid": "4aa8689d-e4ee-442c-96a3-84266e4adbab", "comment": "Malware payload", "value": "3ce3fff409eee1b00b328743ec61d37d450ecacb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303124, "uuid": "da665a24-0fa6-45b0-a001-d38f329c1731", "comment": "Malware payload", "value": "fa50468b0d9b0c373c3f0670fb195d1c8029363fd7a6f908c60e40326c683d2c25293ff4f51d06abda4eb44e9802525d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303124, "uuid": "44af1bef-fe84-4a3a-bc5b-0e604903fffb", "value": "1233C118F102DC60EE1FADB9D5FA60A036AB0AB4F3905CA2BC80E55D59B105D4F777CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303124, "uuid": "98531977-c967-4c44-8417-91c0f4f60d18", "value": "1536:/mlHyQIOf7SieU6ZDvxjxcpAr/USvhWyczsIjQ:/sHyWSiebvxju4/UchWyczJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303124, "uuid": "b0331439-2750-4117-a262-2dd3adaeb938", "value": 51195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303124, "uuid": "d63e0d9a-7479-48d0-b895-9c8f6ae9bdec", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303124, "uuid": "e740b624-4a34-4f84-b4a7-1e72f25afdcf", "value": "deed contract.06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c92675e-d263-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624261083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261083, "uuid": "14e2845c-fb42-4be0-8501-a264dec91bd1", "comment": "Malware payload (Formbook)", "value": "ecce2c5c0b5e52edcf5a9d283b767201", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261083, "uuid": "6a68e9d6-06c1-403e-a6bb-91ec9469ece0", "comment": "Malware payload (Formbook)", "value": "705e75a30a579727ae0ca9ab3c7bd40097dc3467c29e7c3208a51c4009742be3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261083, "uuid": "e933c4be-0c81-450e-84b5-b9684143a235", "comment": "Malware payload (Formbook)", "value": "8d8f01df070d5d9cc6c266d235fa4f8e4385b7d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261083, "uuid": "8d1ee9e4-6016-4f9f-97ef-ca43c77ff375", "comment": "Malware payload (Formbook)", "value": "00e3b4af79609c9991788055d835d8a27829273d21fb5053d5fd9be86dd721ac8ed2c75b15ff9a8da93d45eb4a4299f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261083, "uuid": "df24eead-9263-438f-b943-689da0011948", "value": "C7F49E2027E95719F13BAF7946D47545EBFAFA17B312D45D3CA001CB0A12E42CEA2B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261083, "uuid": "49532132-4059-4811-a3b9-9deb68be857e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261083, "uuid": "e138e6c9-3791-47ec-8e0c-2cdddad29d3c", "value": "12288:Y8YVhhlm4S4F3M9yPfHp+qQdSkhJJbidT0/4NnUyCime1VsY+XnFfCjkENHO+eKi:rYxWyfHUqQdX+dTu4+y6jbaDwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624261083, "uuid": "a0c68170-bb16-4172-9b85-7d40788f9c57", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624261083, "uuid": "8d4bc19a-8e48-46dc-8aa3-feef2d438efd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261083, "uuid": "6ade51f8-9665-47e9-b0dd-c2684e4c1cfa", "value": "ecce2c5c0b5e52edcf5a9d283b767201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea761126-d25a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624257348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257348, "uuid": "99cacce9-6dde-4b1c-8415-e8dc1a14f6b2", "comment": "Malware payload (RedLineStealer)", "value": "2c5330d074cd1cf29bfe37222e8feedb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257348, "uuid": "30713e7b-84f2-46f0-882a-6830a264df84", "comment": "Malware payload (RedLineStealer)", "value": "70bd5b5fb20d4935b5721eed85b1f391f53ca4b3d6ff2b2bc8b7d5b15a407967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257348, "uuid": "f04ffa4d-bdbd-4228-a8f6-8c043f4b708b", "comment": "Malware payload (RedLineStealer)", "value": "a9ecb84aaec72c8428de2fef4a80d64fe6063cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257348, "uuid": "4dbeb246-d263-4be9-b1cd-c4adb568f878", "comment": "Malware payload (RedLineStealer)", "value": "cd12dd3b9079df82b93062af31f6fafa789291a3b0d875de897994bb80ea629f9f9a6c25aafbc5506c14b2948fbcb345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257348, "uuid": "39ee7691-ac28-4e81-924a-1a940f857a18", "value": "D884AE11E7A0C035F2F756F85A7993ACA53E7AA16B2450CF12D52AEE4A347E0EC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257348, "uuid": "ae6087e3-84f7-46bb-935b-035efdd7b31b", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257348, "uuid": "2b68979d-88e0-4c49-bb9e-96b4f0f80863", "value": "6144:GgC2cIioziJXB4tROGhK80J/cMf6rdhaNyEqG5Rm3MoGqD0+KriC:m2cXoziJR4t3K80J/cikaZRmH2+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257348, "uuid": "534ca58b-b00b-4f99-888e-06df17948ccd", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257348, "uuid": "8e2f4c02-2ee2-4879-8721-c4f5874d90d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257348, "uuid": "6f6bb620-780f-42bf-b738-9c388b43f4af", "value": "2c5330d074cd1cf29bfe37222e8feedb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9db8ce-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624298666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298666, "uuid": "9bbb1d92-fe55-4efd-aff0-267a6bc9cc07", "comment": "Malware payload (RedLineStealer)", "value": "a518f41d6fb67a8bc68aa077c1a59bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298666, "uuid": "f2b4756f-1dbf-429c-9ee5-309428111c5c", "comment": "Malware payload (RedLineStealer)", "value": "714a30085b93988295ea7b732d24384db7bb3be843e20acd447ae8dd258db7a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298666, "uuid": "f1101e70-86bc-4745-b3be-125092b3a30e", "comment": "Malware payload (RedLineStealer)", "value": "e0d97b7c823e9f9b5689042634e948a209e940ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298666, "uuid": "08c1d893-93c3-44c3-b0ba-52fc43ab7923", "comment": "Malware payload (RedLineStealer)", "value": "ad7efcdaadf68c451a9636842d750a5f251965bd756e4aa4a493ab5cff093063e345d6722e6eddd3aa8201614f5da866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298666, "uuid": "4e31a1db-ac83-4ee8-b296-4511a01ac4ff", "value": "65D502052B415F9CC4FCC63BC64E383417EE9E632722F7C93AA172D95C726928E1668D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298666, "uuid": "f5e6b98b-f9e5-415a-a4d3-eaeb862517ef", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298666, "uuid": "691475e2-034d-4fad-8037-bcfa97313d93", "value": "49152:VGD7ro8LUmuRfmXVH2HkL+jgt/sN5ThqSV5YOuANp8jf:QD7EYUmnVH2HkYgt0x5Y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298666, "uuid": "b5d9c0d9-6fa4-440f-a10a-cd2d277de953", "value": 2884376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298666, "uuid": "a6fcdcc8-642b-419c-b823-7bd671f3d3ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298666, "uuid": "0552a975-e41d-4c43-a032-b61f9836a469", "value": "a518f41d6fb67a8bc68aa077c1a59bc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fa5070-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624258876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258876, "uuid": "6203342e-013a-4544-92f1-f60160975f9c", "comment": "Malware payload (Loki)", "value": "40ec8298d8f43f99eac6d278073ac305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258876, "uuid": "facfedf5-b5ff-4abd-9318-d0aa4b4191a5", "comment": "Malware payload (Loki)", "value": "716febe5997423d5119cf34fac0bc06ba25709982fb291c8d8ae57c47b923646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258876, "uuid": "8a890658-3b99-4ad0-90a8-8033fd45b89a", "comment": "Malware payload (Loki)", "value": "5c7c0942d31856b68fd551198b14e0db6991de33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258876, "uuid": "d243daf6-3aa6-4d58-a4a2-799804500419", "comment": "Malware payload (Loki)", "value": "6ed3a6b0af2f5725c91d6ff734f8b3aac0977f125db1831fa38f82f27506b8166a7d5a98acb88e1ad049ca302c7a4721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258876, "uuid": "fe02857b-6056-46e5-9c35-8457a4e76306", "value": "59E4AF7039EEA10DF577AF781AE436E2967F7E577B07995C24E4234A47238028F80938", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258876, "uuid": "d6f1dafa-27d3-4aac-a7ad-ba350972b86b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258876, "uuid": "7ce19146-26e7-4eb6-af06-34a7f8ffc257", "value": "12288:JDch8R6WFHmskDfbxUB+8/K5yVjgV8ll138RueLLKeY9eHhU:J4IhH2DlUB+8/KEiV8lltCDLL3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258876, "uuid": "11a66f1f-0ee7-4eda-8c71-cea7fd183af7", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258876, "uuid": "14e92409-1cc6-4f06-864f-233d452f621c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258876, "uuid": "4e44a64b-47a6-449a-9351-c6bd687c5501", "value": "40ec8298d8f43f99eac6d278073ac305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc8cbb6-d295-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624282530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282530, "uuid": "a705b827-8f1a-4078-9540-f32b745a615f", "comment": "Malware payload (Loki)", "value": "65e1e4df4008ec6617c97b0a33658036", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282530, "uuid": "9b7d75a2-df9f-4912-8766-3adba1c98907", "comment": "Malware payload (Loki)", "value": "71d88df0dc314e3e3c8d7275a9e5c7d98a5df1bd5609fbf8c186312d75bf312b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282530, "uuid": "0b187683-526e-4ad3-a450-ef509c21f925", "comment": "Malware payload (Loki)", "value": "6834b1fdb073c89d734d0978f80e724cac8b6936", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282530, "uuid": "5f00004e-88fb-4de6-9019-43cb823dd2f0", "comment": "Malware payload (Loki)", "value": "419820f4691a7655f0a86a54daf2a79c4ea765fcea00fc3eb1f1214f86bb8be95380c624d079b9375506cc044c695247", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282530, "uuid": "f123de57-b1bb-45c1-8a4e-fcd45bfdbc43", "value": "B281B3085BFC1886CF5286F0C5B9FEB646EAF52D83CB557A332DF4B107AA7614E14881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282530, "uuid": "5e170073-1013-4f3b-b38b-58cfe744fff0", "value": "96:n6A8DlZMlApFTzqQSUonNV8TXZaiLhOs9ipiKAr17VOtD:8MlAXzqQSUGV3QqiJ15OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624282530, "uuid": "52b064dc-5e7c-43ee-b07f-2b158fb94c96", "value": 4068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624282530, "uuid": "e85a6019-b8a5-42c8-bec6-b1ad45da1d94", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282530, "uuid": "7174864f-1bb7-4a0c-912d-37c67fa1ba29", "value": "Order_576376927927929.docx_______________________.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fc5d7f-d2c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624302388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302388, "uuid": "406a4497-e98b-483f-9309-27d2cc6a03c2", "comment": "Malware payload (Mirai)", "value": "d10e657bd1d96c28667a2466244484f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302388, "uuid": "44ba5305-b12b-4201-92ac-201ad89832fe", "comment": "Malware payload (Mirai)", "value": "73c16a3ea3f57b43c26df5b6ac0b70571e5c4579e867f379ad292ac64e708c77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302388, "uuid": "20894ba1-c86c-40c2-a788-d682c17dd616", "comment": "Malware payload (Mirai)", "value": "546ad401664501dfdf6c4c42823d99937271f6be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302388, "uuid": "6583c405-0488-4f96-82c5-b81897d0fb39", "comment": "Malware payload (Mirai)", "value": "209a4be03d56fde10e73e612e43ae891de7ccf0c7503d84f6037a6c416c14b23ba35c3024c9f510131043864442e58b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302388, "uuid": "e91299b3-8738-4756-936d-0de9704f6911", "value": "512302B8F24AE053FC6AB1E4CEDD4D61DBB4AC4F540119C0D1CD16122B2AE3D524EECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302388, "uuid": "574e5be0-cc88-4ad4-854a-b53c22dcbfb0", "value": "1536:uD8uTaUYPT8ZTYHi+iWTEeDAHL4u+qgw09CrLvbicwopUoR:uddMT8ZT8i+FKHL4u+qgwhDwoDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302388, "uuid": "f149835d-67b3-4502-a783-fdddd349f66f", "value": 49928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302388, "uuid": "6e7e609d-c04b-4e58-8f27-a68cee91a7c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302388, "uuid": "13221bd4-188c-43ef-b080-6bb7ab785203", "value": "d10e657bd1d96c28667a2466244484f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe4c46c-d29d-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1624285865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285865, "uuid": "c4ff76c3-47db-4fe8-bbe7-292c85ecab10", "comment": "Malware payload (Vjw0rm)", "value": "e3cb5fb484ec5e048872f59a9d48bcd3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285865, "uuid": "c2204139-b851-40a6-9691-cb7638216dfe", "comment": "Malware payload (Vjw0rm)", "value": "7437f9bdb9a271fc9fa6f4b165675e08d53c00e62a61e634c4ee34ed01b73b0a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285865, "uuid": "aaaf4985-4c79-4c1d-b7b1-e10c991e576c", "comment": "Malware payload (Vjw0rm)", "value": "ecd7f55a9050d3af0110e857a2133507108c8609", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285865, "uuid": "72b9febf-aeb0-472a-89da-f4f5c011d22e", "comment": "Malware payload (Vjw0rm)", "value": "15f7b9c953b5cee13ba05f0dadb0ad76dbe93d2a7935d560e75a9d6bdd93f2c8823f8eebb1b333b947d74c027568691f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285865, "uuid": "7511cb30-3427-4737-a911-df2fb9ef642d", "value": "8512AF9579359353944A02CE8CAB4E98BA9FB63201D2F6BCD3CACC045C9EB5BA44243D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285865, "uuid": "170ccaee-cd96-43d9-864c-6e7ef052eb15", "value": "192:QjIO3q3bLXnoywN6AsZQ4aLSBjfrWqe4Bzc7mHWn+zIs7MtzEG7:Qp3q3Pn9/AsZQ4uSBjSugo+na6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285865, "uuid": "59dc9646-4615-4c51-b9b8-71c5fe116161", "value": 9443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285865, "uuid": "4b201e97-55cf-451d-af35-b8cd20b2d161", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285865, "uuid": "475ca439-8ae3-4d02-adfe-9669f5c3443d", "value": "TBA1610955.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dc16dd-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624284028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284028, "uuid": "01eb48a4-e443-4395-8082-00aa00afe807", "comment": "Malware payload (Loki)", "value": "939ca2ef854c719b3b3a384663c77909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284028, "uuid": "90459695-e5b8-42e8-bdf9-b96d02d11fc7", "comment": "Malware payload (Loki)", "value": "753fd4ac5d5cc6ffc23e3f3f4d392a68d369c3821ab3ab739b58732d16d3cc88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284028, "uuid": "9bea39cf-1f96-4075-b2ba-d347773b1e0d", "comment": "Malware payload (Loki)", "value": "bdec193bdbdaf3237008503b44b1cbf180d6f7f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284028, "uuid": "9f8e5cec-5602-416d-b022-5d1cf69c9024", "comment": "Malware payload (Loki)", "value": "7ac5f006b6ed9183f6c9fa88a477a374a5d185b663d2b533e0398239b5633f43580a31a4c46621d6b8d6fe91431735fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284028, "uuid": "d8222476-36c6-46f9-a158-d6dcb2605ffb", "value": "0325AE220ECF422DE2754FB557B0BC46C2B6ADAA3704A2153DC031ADCA375DADDEE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284028, "uuid": "c0dd9b80-5ea9-4ed0-9a72-8aebe22d7e7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284028, "uuid": "95169edc-dbab-41a8-8aeb-1ad5c4ee1fe6", "value": "12288:I2EbWFHmsESMPQipP5kCYbYNysQy5Lqix4yFXRBnavOjMSUMe5zbBwHUpqp29afe:gkHFipuYcpatnavBDMK6HUvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284028, "uuid": "9dcc5867-4c2a-4d62-9f00-8db565e014c9", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284028, "uuid": "dde2be1b-f5eb-42f6-93f0-2e0b340eb967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284028, "uuid": "6b6586b6-6870-41ae-a6f1-ce82c2f1771d", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.1333.1155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9297f121-d27b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624271374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624271374, "uuid": "0db701c6-5c88-4525-beca-e929ff043ce0", "comment": "Malware payload", "value": "b1fb52e85613f41ca2e4927e4c1e2572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624271374, "uuid": "6b8fdcf2-a730-4a90-85a5-fe704adf91ae", "comment": "Malware payload", "value": "754c57ce43af141b69f496d6dbaa006be12e9c178d504742a2c151f1c8c646d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624271374, "uuid": "6251bf9c-9def-458f-9b73-e49106d577ca", "comment": "Malware payload", "value": "1121eedd121bed3671b6d37e71c24491cae7648a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624271374, "uuid": "92ebd931-c89d-4354-9791-814400a0bb3f", "comment": "Malware payload", "value": "105f77f44443763e43499f9c5e8cc79596fd85efbec46f1aba11b7c291a22cdbfd4cc89b9d42564b08d2e865b85bffb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624271374, "uuid": "f0505be0-272a-434b-9f7d-dacbad013d27", "value": "3836332EAADA1C75FE171078E3824186013E8E15EDD10A7FD7E07F16B6B0D83E5A6748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624271374, "uuid": "1b222d2b-92df-403e-83d6-2be9b9078bcd", "value": "446b7557e42bfc440d0ca6f8a6a5f455", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624271374, "uuid": "df98fac7-e096-4b66-b8d9-c204e40a047d", "value": "98304:+yS28dONkkHFlUpvpfCQZRT1wX7G51A9j5Qf1DuXrMFaYLPWjqt5:JIdHkHFepvIyCX7Y+1W1xYYjWjqt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624271374, "uuid": "321e9173-cc58-457a-82e9-4d952bde891f", "value": 5242424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624271374, "uuid": "544096f6-85d8-42f1-ba03-78494c20e615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624271374, "uuid": "c08cdc9d-e6ac-4eee-a68b-ca6928dfe02e", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ff2928-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624258332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258332, "uuid": "72abe04f-a892-4bdb-8fbb-559921ce65dd", "comment": "Malware payload (AgentTesla)", "value": "ffb32906c3c966053a36beb38f6b3134", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258332, "uuid": "d4d0be7f-ee8e-42e7-866d-a481aa364529", "comment": "Malware payload (AgentTesla)", "value": "7554243075d02afb0fdfd243b0376e30dee7305b6e746e103b6a5cf64d8616af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258332, "uuid": "87a4dcf9-474a-40f8-8c8e-04b4c45d7c95", "comment": "Malware payload (AgentTesla)", "value": "14b027208e63a2db09c7caf0ee4e1fc3e18b9615", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258332, "uuid": "63e9af48-97eb-4148-9684-63c6441bbdd0", "comment": "Malware payload (AgentTesla)", "value": "e96f5bb0982a3c396bfd89c0710acfb84c17e568cf69ed4f60da9aefb785d86932b99a10100c842a885e4cc23592de49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258332, "uuid": "774cb996-bfbf-448e-8d46-1e261e09c892", "value": "CA64AFB876047DD6667F136BCA96ACED13B6262399CB94CD40B8B7C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258332, "uuid": "32941c2e-720a-4ddd-b0a1-888160419e18", "value": "6144:3rClGn3xWAlrMRXuQQwJAHS2MxYc4zW/CxRPJA6nq1Joz8e+:3rCY3llr8+cJuS1gzWGPJA6nqToz8e+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258332, "uuid": "f1c67a1c-8351-4a9d-a7b5-023660a196a0", "value": 315719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258332, "uuid": "a1d6e4a5-58b9-4c6c-8110-4226d93a55c5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258332, "uuid": "6161626b-f31b-47fc-b324-e1011e83b45f", "value": "Sampath Bank_Payment Advice swift.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edae9a2a-d297-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624283553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283553, "uuid": "da6e6c75-beec-4f99-abd5-93bf36da4152", "comment": "Malware payload (AgentTesla)", "value": "c5674ed396bc9f2de1ed2b8af5fefd57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283553, "uuid": "d1cba1b2-1718-45a7-b6c9-bbe5431daee6", "comment": "Malware payload (AgentTesla)", "value": "76a366b90a1ba815a66a10390fc7e7b186cb579d98d817309e26deded3cb7b7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283553, "uuid": "5d6bb00f-bb8c-4b24-a98f-b1c2d813e213", "comment": "Malware payload (AgentTesla)", "value": "23162b0281d7338c0ccb3f6832072a45e7a86b46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283553, "uuid": "3e9a8251-eb8b-44d7-a48a-5381c5e7c4b6", "comment": "Malware payload (AgentTesla)", "value": "98e6c0836209daab70970f581d550765e111157b1ff49d7823d5bc8a519de3e948fa6f9567696fd315b40cb6925f53ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283553, "uuid": "03172954-0272-449c-95bc-86cbf3391c84", "value": "FCF4BF7039EE520DF577AF781AE436E29A7FBE577B07995C20D4234A87238428F40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283553, "uuid": "228251b4-0acf-472d-927d-f3619fbb4005", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283553, "uuid": "dfd76b5e-fbf4-42de-8322-e0a252310717", "value": "12288:PS3kJPYWFHmsZw11Ms/1kkkJmdwC5gwducDPk+GFUqgTJ28HhU:PY+PrH411MY1kkkuwC57DgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624283553, "uuid": "aefa3cd5-e39b-415f-a926-3aa0e3576b84", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624283553, "uuid": "e2de1a38-1855-426e-8d95-ddb3710353de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283553, "uuid": "a85ebea5-6ede-4a22-ad3c-6562baf58b35", "value": "13934,00-USD-SWIFT MESAJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a9f5b4-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624258739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258739, "uuid": "62b78253-5e65-4e59-beeb-c3a1ceb32c41", "comment": "Malware payload (ArkeiStealer)", "value": "75d978678ae5e04154f1a90d3dc27ea6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258739, "uuid": "96a148b1-9494-4827-b144-29fd0d74dd3a", "comment": "Malware payload (ArkeiStealer)", "value": "77088c2f6f9178e0da504d14ff3687ce5dbd4972a0cd527b900657132e4666dc", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258739, "uuid": "c5f697c6-7d44-484e-b293-4558ab7b4ffb", "comment": "Malware payload (ArkeiStealer)", "value": "6d55572c7a40ca35f12f72670a72eaa18a2fb71e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258739, "uuid": "fa0e0e04-d38d-4b17-bc24-4fab02b39277", "comment": "Malware payload (ArkeiStealer)", "value": "c93e588ca8529a3a2a04803b5d8e9359ee6728e611367bc6af92c664d5912736643d9babdf6084e8e5004a3c6b98a39b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258739, "uuid": "4d6a15e5-7d5e-43b7-8fbe-12912fadca4a", "value": "2A051239B2824536C1621276494B93B6B93BBB041F3C55CFB7DC0E2C8C277591A7A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258739, "uuid": "3aa306bb-8e72-4434-8d83-35bd88759f54", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258739, "uuid": "c9e2f7e1-ed98-4f03-b121-72335f1799f2", "value": "24576:pAT8QE+k0DOiRQ+yLydZC5NESXUH1IqFi+:pAI+vDLT0WZCoxHNw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258739, "uuid": "db0b619a-734e-4603-a780-60cbc8784120", "value": 842028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258739, "uuid": "7007d0b4-f73e-4312-bca9-f544c06ef1e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258739, "uuid": "f119a108-927b-4a8f-8e1f-db9eeeda4217", "value": "75d978678ae5e04154f1a90d3dc27ea6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a28f05-d2a9-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1624290967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290967, "uuid": "6c8e86e1-08aa-405e-8d57-fc3b1bbc6524", "comment": "Malware payload (OskiStealer)", "value": "ddb4c1652615787cd7f1326e5852bf66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290967, "uuid": "61731de1-84e3-4071-a0b1-e11344c51df1", "comment": "Malware payload (OskiStealer)", "value": "77a04b2b2e8bf13abb35b02d0c9cbbaf76e5be02995d3124f01f641841c280ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290967, "uuid": "45708b7b-3827-42ea-98b4-91c6058077d7", "comment": "Malware payload (OskiStealer)", "value": "708493d0c238a1f0ded55342056aae2e540ccb15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290967, "uuid": "e24b5c89-193e-4f5d-a467-bce9c78e051c", "comment": "Malware payload (OskiStealer)", "value": "451fddebc0c0c34ce1fcd1cd795fde14c5a1454403658d5c2b07ae00ecd3438963715f7a91002ddcd34e94bb1cf2726b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290967, "uuid": "462243fd-7889-42eb-ab23-12e609c63e25", "value": "0C146D30B690C035E86310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290967, "uuid": "662e0a79-78b7-4201-bb79-e351dd06c301", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290967, "uuid": "b4899a18-757f-4cd9-9021-d6a518258390", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIX1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNG1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624290967, "uuid": "0f56181a-8392-4058-9e41-3a9341358fc9", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624290967, "uuid": "bbaf218a-057f-4c5a-b92e-6b3b9a49c888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290967, "uuid": "6f89ad10-5977-43d6-b798-5ac67bd92cf8", "value": "New Order Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c24becf-d292-11eb-875b-42010a9c0053", "comment": "Malware payload (NetSupport)", "timestamp": 1624281027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281027, "uuid": "00b9dbbb-7931-4355-b931-4ebb065fb1b2", "comment": "Malware payload (NetSupport)", "value": "e66d3a6a4e87aa8d4a42ecaa86222310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281027, "uuid": "d2d58464-823b-4d48-a8f2-5441b732150c", "comment": "Malware payload (NetSupport)", "value": "78340f48ddfebdb48ee1ef2d5fb0cfbe3f4f0977d4ee97ce9b21c06be6bf22f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281027, "uuid": "b387569c-0a40-4ec4-8e8a-bd08a6d542a3", "comment": "Malware payload (NetSupport)", "value": "2255afda282a6d0d323a626ca5bcc8b1e919b8aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281027, "uuid": "2d530599-f985-4805-a6ac-a6759f38b160", "comment": "Malware payload (NetSupport)", "value": "5df84fd72dccbbe09db6c287e0c2b4d18dd7f9f023766eabeb7a7449381482e7234de9b5946a0e684c6851af7f8da5a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281027, "uuid": "c4f31f27-35df-4dcb-bcaf-d78e2d1d7ce7", "value": "A985B03FF268A53EC45E1B3245B39250997BBA60A81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281027, "uuid": "9f79d366-e499-49f6-825a-e1c46b8f8712", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281027, "uuid": "2fb7e04c-28a1-492c-9692-90c5f968b3af", "value": "24576:t4nXubIQGyxbPV0db26Wy7qKnAsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdOi:tqe3f6z5BSffPMWrQ0Zkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624281027, "uuid": "d374f684-cca0-421f-8341-cb267eec092c", "value": 1764716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624281027, "uuid": "10b433f5-76b5-4755-8a2b-75ab7a04176d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281027, "uuid": "e3380717-8f84-451b-b5ab-122474887f82", "value": "E66D3A6A4E87AA8D4A42ECAA86222310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70ee89d-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258550, "uuid": "a5c1bd90-e140-4333-9ed1-a975764327b1", "comment": "Malware payload (RedLineStealer)", "value": "045874b975b0adceb9f97a9bcd7ea721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258550, "uuid": "3e65e811-65d0-41f6-8204-8f539639edee", "comment": "Malware payload (RedLineStealer)", "value": "78df05e5319ae2a6665c83ffcade17c4c3d9cf02d52df3da90d00a8ba96271ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258550, "uuid": "dd2fb7e2-2b8c-487d-964d-46d29ee5c091", "comment": "Malware payload (RedLineStealer)", "value": "877307520945ab4506ed81ca2321abb243f40d12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258550, "uuid": "3fc090e5-02f9-4e88-929f-3c185d956128", "comment": "Malware payload (RedLineStealer)", "value": "cd076d7eb01466b42692900f130fbd67946f4334fa063b413fb2d769dafb6540ae5da1faaa614b6107eb0403fb6b8726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258550, "uuid": "fb47ca3c-27fb-4346-98c6-befa197229ee", "value": "E584BF10FAA1C035F2F761F45A7693ACA53E7AA1673450CF12E51AEE4A387E0AD31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258550, "uuid": "534f963f-3fed-4133-82b0-e9f9f9d85237", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258550, "uuid": "b7fbdcec-41fa-4249-a5d5-cddf8df9417b", "value": "6144:bgp2DItwerO2f4t5OGhK8X7U54MaUPY4nNjd0PNC5JV6lxhXonFsHKriC:42DwwerOQ4tPK8XxM1Y4nJEC5JQlk6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258550, "uuid": "94e413e2-74fe-4bd0-a6a0-7303d24c760d", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258550, "uuid": "84c9e79c-07cc-4a6f-880d-59ef6bc46dcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258550, "uuid": "c3fc9c79-7741-4545-a877-87e48d074897", "value": "045874b975b0adceb9f97a9bcd7ea721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d845ac22-d254-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624254741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624254741, "uuid": "eb04fca6-efcd-4439-9535-94a848d19199", "comment": "Malware payload (NanoCore)", "value": "24b5a8c46c57f523f0a55b876b340ad0", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624254741, "uuid": "f3592c26-6688-4bd9-9a40-3547e91afb7c", "comment": "Malware payload (NanoCore)", "value": "7a007f78f996fc17787ac79bb3a45823cd2e6a00bf257bb96a79cf4fe6a4d9b5", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624254741, "uuid": "c2e77995-b737-4e3b-92ba-0cfe4648a008", "comment": "Malware payload (NanoCore)", "value": "4a02a94e3cb26e5c5afd1be03a797c86c667af6a", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624254741, "uuid": "fb76ec57-00cc-4374-ac36-8effa8719119", "comment": "Malware payload (NanoCore)", "value": "ce15cb3af2913a35480db084261fed9bf7cd25b00f33a3f2faa8489d98eecdc0c3999ef37ae4ca466d976100203dbd4a", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624254741, "uuid": "91ad9e08-e99b-4831-9424-f2e11bd59e94", "value": "83B4231B0F7E1AF4DC46B2E84664A9488EEE2160CFD2F177530AFC0DD7851686669CB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624254741, "uuid": "92ff663d-972e-4471-80ad-06311757e581", "value": "12288:32hD81cyhJG/mqhfxtHnNkZqHWeRp+/mfYj+RbVjNEujN4h:q0G/mMxt9pP+/mwjSOuBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624254741, "uuid": "76e3e6a9-2303-4fbf-9d9e-9db604f59608", "value": 517074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624254741, "uuid": "bc8114c9-b9ba-4b66-96a4-0b9e0d0e6104", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624254741, "uuid": "538a2832-8c37-4278-9563-e844dc6b216a", "value": "REMITTANCE DETAILES.Arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e805ada4-d28f-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624280107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280107, "uuid": "ed779ed4-c98c-45dc-8f5b-8828b8fd87f9", "comment": "Malware payload (GuLoader)", "value": "7e3ec4d537c678eb204b9442b446b400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280107, "uuid": "66e4f47a-9549-462b-8b3f-aa07da5843c7", "comment": "Malware payload (GuLoader)", "value": "7c72d2e12ed2db6353a373d16c07eaf27fbf110c75a2dc7535ec7d624cb42012", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280107, "uuid": "79318a31-a3f1-42fd-a391-8b588c5836e7", "comment": "Malware payload (GuLoader)", "value": "c8af619fdd138bf8765ffd66d3dd7a8777bbd4bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280107, "uuid": "a0f543c7-c523-4125-bc01-071103def1ac", "comment": "Malware payload (GuLoader)", "value": "6768735a825dbf62d7db39106e02c0ee716acb15439ef55932e08158c5ce985ae820580da72f8da9a72721c3733b54b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280107, "uuid": "151a015a-bdd3-423a-92c7-43c030dfdf2e", "value": "D9048CA37680F833D759897157119BB86DD86C705898C9C3E2C07B8FE6FA6D1C231A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280107, "uuid": "72dd35de-39d7-44bf-9472-93ab2ab51e14", "value": "269fbb82c8f402e670c866cdbdfbba84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280107, "uuid": "60f27e7b-0fee-49a0-aceb-eaf34d9dd85c", "value": "3072:tR/LLx0a4EVawNk/1ISHL2TpsFWsSB9jGoyQRdF:3/neuawG/1ISHL2TpsFXSB1IMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280107, "uuid": "20181924-05b0-4b5f-9153-2ca4db874919", "value": 189496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280107, "uuid": "6f419ff1-c43a-4293-bbfc-1f33771f5f80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280107, "uuid": "87839e27-a41b-4dcd-94b2-7b347ed7d917", "value": "Shipment Document BL,INV and packing list.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ecf815-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624284055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284055, "uuid": "da27e47f-f817-49db-8d77-75d35d3eff6b", "comment": "Malware payload (AgentTesla)", "value": "de08513d3a0b570381cd4eb1d88cbed9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284055, "uuid": "003045bf-97ef-4e1f-ac28-5e4f599b9d02", "comment": "Malware payload (AgentTesla)", "value": "7d34ebcd5418ad89a004b65ace563b8bea5a0e01da818e882f33b3e4545d9ccf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284055, "uuid": "169cea9a-85ff-4f0a-9c26-e9381b83958f", "comment": "Malware payload (AgentTesla)", "value": "e27fbcf2d3ab4023fd3987342e7060bb90d8b181", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284055, "uuid": "3a7f25d3-03f7-45e5-a80d-e4634627c912", "comment": "Malware payload (AgentTesla)", "value": "8d5f3583855b001d0913731589c37fdc1d27eac4d3e4cf643a6714420bc59eec8c104719e4627ebf0d3ce68445713a03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284055, "uuid": "ee98f777-d87f-4d99-982c-36220417131d", "value": "4AF4C02039DEA10DE57B9F781AE436E29A7FBE637B07DD5C20D4234A57238428F41939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284055, "uuid": "2bf64213-c963-4b60-a03c-bace84228b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284055, "uuid": "d0b37c9c-c209-48ab-b0b2-ad1045548fcd", "value": "12288:TkCk/tSpJk5QV3B84sxlcLFh6Ef0A5QIlrr1Mk4MhCX/jOnBtLHhUoKWFHBm:I7N5QBO4sxyL7vsA2cMkPhCX/qBxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284055, "uuid": "4b87c8b0-6afd-4626-aaa4-b111cb30872e", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284055, "uuid": "171869fe-19e0-46b1-98e1-774dbbfafcd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284055, "uuid": "049f88e2-9b20-4e15-83f2-f7a60a62493e", "value": "PI Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328c8550-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624298701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298701, "uuid": "f3421690-2d42-428c-b6d2-a210dab47afb", "comment": "Malware payload (AgentTesla)", "value": "f22c626a68122de8bfa71a2c4143b211", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298701, "uuid": "a148376b-d539-447e-8a46-d9ea51f48ecc", "comment": "Malware payload (AgentTesla)", "value": "7d4f8a9374bbea0f1e39f692a0d3c3f50e4af200d01f736616ba627d8b3fe924", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298701, "uuid": "0a26e0d5-fb5f-4e59-9d75-49991361d14b", "comment": "Malware payload (AgentTesla)", "value": "69d65bfe9c7ceab197236a089d09386ca2d56c9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298701, "uuid": "2746accb-3f0a-4b3e-8e25-baebb7c16c3b", "comment": "Malware payload (AgentTesla)", "value": "54bb7bb82bac04f9c2f7df781f47224b2602d29f146ece7d8e8cb10d16abe7cc6f94dbc4eb4dee5b692cb632f39afef8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298701, "uuid": "b229d6a0-c340-4c65-a127-41a677bb51b6", "value": "F335BF220ECF426DE2754EB557B0BC4782B7ADAA3705A2153DC031ADCA335DADDEE412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298701, "uuid": "b490f963-f6ae-49b8-8928-bf5dba3aa891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298701, "uuid": "3f738b4e-86e3-4d02-a000-5a411190cb23", "value": "12288:6f1/rbWFHmsuSMPQipP5MBpoMAjgwEqpZ5GW9HH9deaM4jUr9uYF9g1z+M04:8kHnipqRAjH3GePeaM44a9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298701, "uuid": "4520128f-a63a-489f-932d-827662941967", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298701, "uuid": "b446189c-1e5a-4659-9a2e-23bbab7ba5f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298701, "uuid": "f2b48b15-ce5c-4eed-8371-544d02ed7ea8", "value": "f22c626a68122de8bfa71a2c4143b211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53faa08d-d299-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624284154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284154, "uuid": "59fa59e3-559e-400c-885c-db4cc1dcdb55", "comment": "Malware payload", "value": "5a0fd5b4897627d2d944df34c92b6880", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284154, "uuid": "609444b5-ba69-4300-aa39-5fdf2135696b", "comment": "Malware payload", "value": "7d50f1b935662741f6a321068c31149c5485cac9f634c0f7cad1d159527972e8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284154, "uuid": "f2379fed-0042-4b6d-b573-7bf0a101a985", "comment": "Malware payload", "value": "69e8e65aee02ca80b7955dc2bb0b99f34beb0a54", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284154, "uuid": "af9aeb9f-1149-4963-b04a-0b17acb3e04a", "comment": "Malware payload", "value": "28800aaf471aae9dca52b5c42060690cdb5f3e9624daff3b0ccf2aec6ef37fc0d4ead28f893f35ba2d8f8ee8b8204861", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284154, "uuid": "7764edea-18d4-406e-91ed-828b63a0d0a4", "value": "82F4D61BF381133A0A724265A60E65E6F726807C7376CA60685ED43D3317C79867BBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284154, "uuid": "109bf045-ace0-4a92-bed1-d79cf067fca0", "value": "12288:WKKDLo4jrvMHRoNrsHNezhBMAV65wSXj0rEiITBCLLWj:WHL3jrvMHRoN48FBMAV65wSXwQiITBC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284154, "uuid": "76f8aed3-38e5-4252-8bc3-6a794a9e5978", "value": 735498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284154, "uuid": "eccbb554-4029-4625-8039-27abb6760041", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284154, "uuid": "e60a4458-713d-4496-96b6-12a8b6c5c843", "value": "7d50f1b935662741f6a321068c31149c5485cac9f634c0f7cad1d159527972e8.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced22317-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624258590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258590, "uuid": "588e41ba-41de-48bd-9b83-06f6251702ec", "comment": "Malware payload (CryptBot)", "value": "ab39f7b0b619a5a0a3b697ee83fa9657", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258590, "uuid": "06848d23-c0c1-4d27-af81-8723b2e231cb", "comment": "Malware payload (CryptBot)", "value": "7db588bd2fd4e5fabfa84445229c8b348b6f78424c97a1ff9a3e20789ce4c812", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258590, "uuid": "337d6d6e-bc44-4e10-b84a-058cf064c962", "comment": "Malware payload (CryptBot)", "value": "e8a0a4032fd24c9ec0dc9448ec226a63411ea2f0", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258590, "uuid": "5ae5be1d-5112-4c92-96a3-cf0fa9be3253", "comment": "Malware payload (CryptBot)", "value": "cf5bb7d600e97a2315f2faa95881cb69cc4c6a8e95d87462d487d45c57298bf25b035f8a8facc4621c2301baba6edc61", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258590, "uuid": "0633090c-38e5-4e0d-89dc-1cc0aaf8b29d", "value": "69F4F110AA91C03AF1F762F859798368A83D7EA1A72844CF12D517FE5A707E0AD31F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258590, "uuid": "7e2ce0c6-70e1-4097-bebb-6a6756d7aa63", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258590, "uuid": "53364ac9-69b9-4126-8d01-ab8ef6b31e03", "value": "12288:dCtlyZ869k+dKP5ITwQiLhI8vSBZ5ETIpPogaKMI4ruWhHq5HO38URsUEeRF4Cpq:deyZ86VkItiLhI8vSBZ5vZMvSWhwHaRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258590, "uuid": "0aaaff3f-9512-46ac-8fbe-92da036d0800", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258590, "uuid": "015b36e5-fa78-45b0-be0b-f2a4257ad5a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258590, "uuid": "abc08740-5e11-45f0-9f16-2ba30ed860ab", "value": "ab39f7b0b619a5a0a3b697ee83fa9657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eae9549-d266-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624262160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624262160, "uuid": "39856d4f-b7e8-4cf6-ae90-edfc53ca9474", "comment": "Malware payload (RedLineStealer)", "value": "115d52b02a5052ec3eef670642af1a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624262160, "uuid": "a75cb65a-f587-4106-864d-9d3249ff1874", "comment": "Malware payload (RedLineStealer)", "value": "7dccea1ec0ad65abfaa89f83ae5298110cacb3a1ac91749f38479edf2496aca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624262160, "uuid": "6777be4c-b56f-483d-a8a7-d2dd74d18ed4", "comment": "Malware payload (RedLineStealer)", "value": "fbcaaaaf8c2e37c65c90684b076c6955f69c3c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624262160, "uuid": "c4e664ff-5e13-45b9-87bb-5bfc6ac9288a", "comment": "Malware payload (RedLineStealer)", "value": "e455927f556de2429603fa80bdaad452c26c71add49616135a37073ae08c7da7054583046b582677700e0684a7dc9366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624262160, "uuid": "b599f492-9d78-4238-95e0-0210b5a7b33b", "value": "CD84BF10F6A0C035F2F762F45A7993A8A93D7AA15B3450CF12E52AEE5A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624262160, "uuid": "dbc8f657-b370-49cf-b40d-acb05361d59d", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624262160, "uuid": "e36e7b8a-5c8d-455d-aadb-367ff5d58c5a", "value": "12288:OzYxAYouNNgFBJyks+9OTjijTxdtglVt:OeAYouSJFs+4ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624262160, "uuid": "a512fd4d-3319-48fd-9e67-b182edcb4ee1", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624262160, "uuid": "5ccf402e-b387-43c2-86e2-aaa0dc2d140d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624262160, "uuid": "c2b09f23-7805-4353-8667-e08da3a35095", "value": "115d52b02a5052ec3eef670642af1a91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f15f47-d26f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624266004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266004, "uuid": "6045b726-efb2-4d9a-95b8-5ddfa24f61de", "comment": "Malware payload (Loki)", "value": "46d62a159798703c5015a45c0ce8c1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266004, "uuid": "9f0eaf8b-6154-434e-b81a-21e1e5ab195c", "comment": "Malware payload (Loki)", "value": "80dc17e49673414cf02cfb5372b4a0fb64b39276ce8b5dd041bac4232bc6ce2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266004, "uuid": "70d79e19-9155-4536-94f0-646c53bcf5c2", "comment": "Malware payload (Loki)", "value": "a51202e370c8678e9613927331d379431d5144e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266004, "uuid": "84d6d326-a17d-4d99-9368-f46732576cd5", "comment": "Malware payload (Loki)", "value": "acd2dcff1493c347ed6fee8a1bc20bdc3bb5f31a9048d9a896cf9d45f1b8d15ebe9272f8c93b2ee907aa46f530d0f6d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266004, "uuid": "d0e0d2cf-f412-483c-aff5-b4eb070f3384", "value": "002518AD325073DEC86BCC76CAA81C68EB907477930BD243A05315EDAA4D99BDF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266004, "uuid": "ee77bf0d-02cf-4bcb-9ef2-f06a336bcff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266004, "uuid": "3456ce90-8f19-495a-9a18-930f6bd51c90", "value": "12288:SGtz9nOLnkgo8ZlXFYK349QoohVIMvEcAQy5xCitc51bArBRCMs/utGCIznvi33s:hbOTHZww19DAQy5AiakrrCDaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624266004, "uuid": "e0f94b82-fdd3-42ca-9d17-1dcaed4f8ba1", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624266004, "uuid": "9a009e4d-dc84-46b4-9cb2-4e6f079f418a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266004, "uuid": "11860399-feb3-4037-8c89-399919437b0d", "value": "46d62a159798703c5015a45c0ce8c1b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7963ae-d256-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624255390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255390, "uuid": "90ba47ad-5962-4e61-9056-14d1c0ddd3b3", "comment": "Malware payload (Loki)", "value": "1723a0ee0a9dc04b1f81b732e832c22a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255390, "uuid": "312c223c-0862-4854-b0e9-ca99a5d748c6", "comment": "Malware payload (Loki)", "value": "820dee77738574f44c33667713284e557a45fb4d0a035c7869e7b5017bcfa2b9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255390, "uuid": "d2e0e1c1-4c57-492a-9178-b08b61fff783", "comment": "Malware payload (Loki)", "value": "b1a4989577b02dad7fc5eb382bf66e9203db2d99", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255390, "uuid": "cf5916bd-c8ca-4876-8a68-22cc8a5b94d2", "comment": "Malware payload (Loki)", "value": "dad8b4f3a1e7cd6097396b8e938a76cff932457ceca24ced9ae55a915900a529ead6ec1067132b64069385ee46bc15ab", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255390, "uuid": "d9eabb8e-37c3-4c1f-95cd-5108441c74ac", "value": "B6A423F6D3E0D401BA8165569EEB0B83761A1F705BCBEC5DCE88673D538728D235680C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255390, "uuid": "48295ec9-7e83-41b4-84f4-7e1818128da8", "value": "12288:u5Hb78TgwY2jGeVXy/JSWaFDejcjGABdnXztCfdGIFgFPmWk2lK:Sv8sbGGeVXcuDacCABdXcfFaBmslK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255390, "uuid": "31de82ea-ed89-40ec-ad14-49a7c7594b60", "value": 485416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255390, "uuid": "97c91c82-7f19-4b0b-8bb2-b7a91856b79d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255390, "uuid": "8e5b4a64-d91d-4bff-9567-ab88dbe96518", "value": "Order Inquiry_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17973b3-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303209, "uuid": "4798fcc4-d7df-44c3-b21c-e416c70eb227", "comment": "Malware payload", "value": "2a1ef5901a193c62ede1263221799149", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303209, "uuid": "f13c669e-2fac-4f56-91eb-78578d79d03f", "comment": "Malware payload", "value": "826805ccac4cc3826c361b8901d05b34794a125db697a084c6e5c7054e88705f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303209, "uuid": "0c476a8d-cf15-47cf-88f7-bc34d5ee2bd5", "comment": "Malware payload", "value": "29ec709f23159217b8845abf0e2d9d53af405e49", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303209, "uuid": "c441ae3d-8b68-4aca-ab1a-bdac85e86feb", "comment": "Malware payload", "value": "5045c339fc4ad687d9877934a12c801c1b6f6d82bbf598ead1e19a6bf5f44f9bd521661d7453f883b38ee06621dab99f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303209, "uuid": "d5b64b22-7440-40a7-bb0a-b388bb14bc3f", "value": "5E33C008F112DCA0EE1FAD79A1FC50B076AB16B4F3909DC26C84A55D5DF306D8B2B6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303209, "uuid": "bcb9669e-8e56-4566-954c-7affed1cddff", "value": "1536:/oH78QIOf7SieU6ZDvxjxcpAr/USvhW7O1:/oH78WSiebvxju4/UchW7O1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303209, "uuid": "b59c6af3-9104-4320-baf4-1bd20ef1ba03", "value": 51648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303209, "uuid": "c8bbeee9-e763-4323-87d8-77a6965351ed", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303209, "uuid": "a22aea99-168b-4562-8c5c-d0411f501212", "value": "material-06.21.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b50373a-d2bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624299226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299226, "uuid": "ef079eb1-594f-4832-ab49-3b89185dc0f0", "comment": "Malware payload (Mirai)", "value": "31a83e3e20a59e88af9879d8383e28b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299226, "uuid": "cdbed370-314e-49ba-9340-d9b3df3bd729", "comment": "Malware payload (Mirai)", "value": "83d80857cb1165decca503e7110ae240ba15b5b150d8d26d3a703ce49a6559a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299226, "uuid": "22704f74-21df-4c6e-9a38-95733add7544", "comment": "Malware payload (Mirai)", "value": "675058be5817b5b963ea2df154e8bff5e48685d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299226, "uuid": "7d2c9214-e9b1-4a61-807f-b19b9bb169ba", "comment": "Malware payload (Mirai)", "value": "a99ce0238752f03222054f9bc8534efd4f9650480ca0253acf562bce02a4d12c27b946906391ea85ac6d279a21afdd4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299226, "uuid": "50480984-a134-4054-a866-f5e7a55b176d", "value": "31338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299226, "uuid": "4829d401-eb82-477a-acf4-9a6b138af7e2", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvz:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624299226, "uuid": "dcdf9cfa-3635-413f-ab09-e4ebbe38a568", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624299226, "uuid": "25188ae2-9149-457b-8f9d-1fd18637c283", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299226, "uuid": "3063704b-9166-4900-b2a6-e4f75acff5c0", "value": "31a83e3e20a59e88af9879d8383e28b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003c8d2b-d25b-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624257385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257385, "uuid": "8517258f-d67f-405d-8777-d3be1a5835e8", "comment": "Malware payload (AsyncRAT)", "value": "0cf81488568994167588177673d0daf3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257385, "uuid": "72a2e9e3-4d66-4b91-bb08-5904d04b6bff", "comment": "Malware payload (AsyncRAT)", "value": "8403c57936639ceb93873d1e3033ed114bfbd1b85c8c0dbbff237566f442b9ed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257385, "uuid": "46d0fcd7-a335-4eef-a371-62665bd67af1", "comment": "Malware payload (AsyncRAT)", "value": "291d612acd7a14aeec4efc7998e646a4f183caed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257385, "uuid": "6841bc9b-42d2-4c38-8d79-b5937aefd279", "comment": "Malware payload (AsyncRAT)", "value": "9433c33a0669c9832ebb2c55b01882c771f892401d9ff165a7025220c509e91ebc2e077c4d413de0957a727bb563af11", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257385, "uuid": "94b6bdf5-f4e5-4b38-b0fe-b5180ad51232", "value": "902549A8315D719EF957C47189642E70AB212C6693CB96DEA393339DEA3D4C78F030B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257385, "uuid": "82f3d3ff-5e32-4190-bdb6-c85f63cb4312", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257385, "uuid": "6852a0ef-bfc8-48cf-a864-c919f4e04bff", "value": "12288:lcvBdB9c3HhUCSy9hSJWPvaiP1t/uv0S8G/pAZNPy/bGZzEhIxwW1/RPicSdBzLB:2BdBi7J9hSyva0tuvVH2Z0G78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257385, "uuid": "856dcf6d-bd8c-490c-b8a3-6da6f7ee5add", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257385, "uuid": "bc3e0ccd-8dfe-45a9-a72b-0e5dd516397d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257385, "uuid": "e42acc5a-cedc-4f62-bd1a-32d8a062a216", "value": "ORDER-#216448.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee87b5b-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303285, "uuid": "55a45599-ce85-45de-bf87-3a85405393e7", "comment": "Malware payload", "value": "8dd8b262d09ad5d9e729b22d857a78ce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303285, "uuid": "0f54b445-c147-4ccb-af26-78ac257109fd", "comment": "Malware payload", "value": "848229c38d65277f2021ba9cabb1284e9160bdd9c816b71077027af82f040222", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303285, "uuid": "19bb77f8-159a-4bbd-8a11-a5b4c950f981", "comment": "Malware payload", "value": "ba36c4a182e4346c432811c84607d3024f076460", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303285, "uuid": "9c91ccd2-7e0c-4631-a5f2-f4ee5e4233ae", "comment": "Malware payload", "value": "bd355ccfb8420c4dec5a7f370d55f3c9a40ec3b6e397319584650cbe57c48f3416dd058ed77831e440551f0b1cb98e9e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303285, "uuid": "9932adf0-f5e1-477e-87d3-4f75a4b71390", "value": "C533D054F101DC50DF2EED78A5BE20B076AB06B4F3909C926C80925D59B216DCF3B7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303285, "uuid": "72667654-a501-4f0b-990d-9ace6e9103dd", "value": "1536:/5DSIQIOf7SieU6ZDvxjxcpAr/USvhWyUR:/kIWSiebvxju4/UchWlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303285, "uuid": "8dab7dfa-e882-4c34-86f1-b3a24d6cc010", "value": 51344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303285, "uuid": "50b87e83-a35d-41e8-a47c-d1afb0acac0e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303285, "uuid": "921a9bba-f63b-471b-b2dc-1a346f934c3d", "value": "tell_06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01ef300-d2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624311045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311045, "uuid": "e8f716de-3f32-4746-890c-e6f0056902c0", "comment": "Malware payload (Mirai)", "value": "907cfe941fbc203d452ccbbd41486ba8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311045, "uuid": "a8946e58-8fd2-4147-85d7-af6f43843896", "comment": "Malware payload (Mirai)", "value": "84f3524f0fcababf20c00ad0534671a24a9838f9e5db166e1bcfd36e6d9887d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311045, "uuid": "ed3dab4d-9d51-4fdb-9c54-69597e3b77cf", "comment": "Malware payload (Mirai)", "value": "cecfdee27754305cbb727e3101214ffea3e927b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311045, "uuid": "05be231b-63b4-49a0-ac65-662c4fc571b6", "comment": "Malware payload (Mirai)", "value": "d7c4fd6c9eb5aa5ae635106a642c32d46306989672fd802816667ac77e32c94c06ae35947db06b7cfe73ec5db13f85b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311045, "uuid": "2f61eed0-5705-48c3-a4a3-24a717cf2076", "value": "6273A40ABF611FB7EC9FDD3749AA1716288C551A22A93B757E30D818F24B24F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311045, "uuid": "3952c1bf-9441-4df8-a537-6704ac04c9ca", "value": "1536:aqJw3YsM8gZgkfLpbBSsZjZbjZXxhaGAzwPH:aqJesFZgkD9bjbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624311045, "uuid": "868fd875-e773-4775-b3d4-cb8a2c74c051", "value": 80052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624311045, "uuid": "3130410d-beb2-4b1a-ba7d-617c6041142c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311045, "uuid": "7ca8c401-fc2e-47f1-890c-757dcb8c5245", "value": "907cfe941fbc203d452ccbbd41486ba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ba6add-d28c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624278600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278600, "uuid": "812c87c7-f32b-45e3-a1f9-4c3a493d2901", "comment": "Malware payload (AgentTesla)", "value": "540b22827cad2837ef4f1b5108f35f43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278600, "uuid": "6cc3c51f-cae2-4f3c-84d7-f0a3829611da", "comment": "Malware payload (AgentTesla)", "value": "85d7a332f702ba4a380f0d2cf7c62b39f803615327c21ea177d720159a588dc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278600, "uuid": "958b78b1-fc83-4d03-ad11-2f6cf63d3cfb", "comment": "Malware payload (AgentTesla)", "value": "56df713af69c9d3b38f87edae8db96d72c02724f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278600, "uuid": "5b28f271-b887-4af4-bd65-0c48de5cb2db", "comment": "Malware payload (AgentTesla)", "value": "6fe5d40c25e59a9071a0fbe4675544d6c705f943b8cab90f4012c2241507d73e3f97f1a55275cfa5655eb8ead05ab62f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278600, "uuid": "8b218cc6-e8d4-4053-8692-87c284f4465f", "value": "98B4DF897760B69FC467CD3A8E551C24EA20B47B530BE743944B16EDAA0E6DBCF011F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278600, "uuid": "1bdbba6c-945c-45c6-af77-7c2db89467fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278600, "uuid": "693cb28b-3331-4bc4-a94e-5ffd35227494", "value": "12288:/NpKm4bD4j2VtDJhzV72pmJck28RT9Id:/7VQnVtDDzVC8Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278600, "uuid": "37c12604-f5dd-40a9-9642-21496d5702fa", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278600, "uuid": "727eccf7-f54c-4608-9563-b2248be73d2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278600, "uuid": "9998605b-8b79-4383-918e-73d9f23d3faa", "value": "ORDER.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20ce43d-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624284392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284392, "uuid": "16ad9491-0cba-4430-b51b-691a266b4746", "comment": "Malware payload (AgentTesla)", "value": "6ccaea495ae9b1c0e0fde5371af6e3ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284392, "uuid": "cf84be52-e87e-471c-aa34-d122d8d9b6ff", "comment": "Malware payload (AgentTesla)", "value": "85e24cba4e9ad1c62ec7ceb6e0b3339644c67a71bb1f8a5bd9d6bcc99feb9c05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284392, "uuid": "d4b1424d-c66b-4de8-b0fe-49d118f94886", "comment": "Malware payload (AgentTesla)", "value": "8eafb37e8998f982e68df45e0082e8e1ae5a0996", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284392, "uuid": "9ddbee54-df7d-46cc-b976-c074f991822e", "comment": "Malware payload (AgentTesla)", "value": "c9d9f8f570632979ed1e9f478051c5d17b6260f81ec020efc5fd803ec1df47538c27e5690d90ff6884d72cf87991d53b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284392, "uuid": "58a8c952-d18a-4e3f-a0eb-4fbd831367cd", "value": "18F4BF2039EE610DE57B9F7819E476E29A7FBE677707D95C24D0234A4B23902CF80939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284392, "uuid": "27c73f08-49c9-4259-b65a-7b51151efe75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284392, "uuid": "b98d8324-54cb-41aa-b988-d0e03ea4c82d", "value": "12288:JP3MrzWFHms3WO7Z/kdfWm3YCcAOeAmcnPiebBlQam1sJReHhU:JfEsH4A/kdfz3YCc1eA/nPiWlFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284392, "uuid": "be4b15f1-d0d0-43c0-8a02-12bf23976653", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284392, "uuid": "33c6e8f2-a6fc-455d-a7b6-355d041c9ea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284392, "uuid": "56ed58e1-3cb2-49ac-b923-ca137bf3e425", "value": "Payment Advice Note from 21.06.2021 to 608720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21149698-d2cc-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624305973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305973, "uuid": "3e2f6e88-bebb-485e-a43f-485d7c3f2aae", "comment": "Malware payload (DCRat)", "value": "2684245cfdf48176323633a052ab3bce", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305973, "uuid": "b72c24ae-e324-4ee7-bb2e-e5a94cb7d608", "comment": "Malware payload (DCRat)", "value": "87803d5fddc393b81049491ff4fef5216c7807fd01dd036a0c692a89b151e575", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305973, "uuid": "84caf49b-3e8a-402d-a226-60fc160a6833", "comment": "Malware payload (DCRat)", "value": "0f3f7c82d0cb0dc61540a970b70e3f889479dd13", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305973, "uuid": "8bc4ffa8-5730-4f14-8f9b-29ea1df59bea", "comment": "Malware payload (DCRat)", "value": "275a7c9ce7ae31e045db1894d6008b4b085cc4083586f66f7d3dd85c132fe36883277afb9a580efa91fbc4eed10b6b1b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305973, "uuid": "570ea20e-acfb-468d-bb75-6b25d129a1e3", "value": "6B756A723F47DD02C4291637C9FF442907A8BD092B66DA1BFE9B3B9D65513A20E091CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305973, "uuid": "c9592dda-8962-4b77-92d8-3d37bb5eeba7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305973, "uuid": "c3b47669-bd20-4b40-b995-6c6eda1c09b5", "value": "24576:P2G/nvxW3Ws0clUwSmZyoeC9nq8SBSJQE13mgZsaPx8AyYJ+Z8LU3rRH8+4P:PbA3Mcl1om3PxhLU7Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624305973, "uuid": "532acacf-796c-4b99-97a3-609decfdc40f", "value": 1689831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624305973, "uuid": "aba2186a-927e-4917-8ec3-a559449a40d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305973, "uuid": "69559a67-f4e2-4c57-a6eb-9a8c30256fac", "value": "2684245CFDF48176323633A052AB3BCE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5463950-d2c3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624302383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302383, "uuid": "8643db47-4c9b-4c4d-8107-292e8ef36c21", "comment": "Malware payload", "value": "25eff78a8356ada08e1d605243fb2418", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302383, "uuid": "8b91e996-1ea5-485a-bb00-25f6e5346256", "comment": "Malware payload", "value": "87a6cbb3b4301ad58a430092314a628b6fce9617b597d8c5f6a2a9ceaa477a56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302383, "uuid": "92874f0b-bd26-417f-84eb-c132398941a1", "comment": "Malware payload", "value": "f54c2cbd41f2068751bd32ca0067b05070e5db58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302383, "uuid": "036cdbfd-26b6-4e85-af7c-ec10d2b0f023", "comment": "Malware payload", "value": "684e505680cf6b0bdbe62cbdffb9d5e2daeb62af3b3467e9047a87fe99d0e8ef2ad32bb5c47f7fe8563acd3750226d7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302383, "uuid": "ae1a094a-ad4c-498e-b403-15a315592b5b", "value": "F343011CC8A95995E52812F2B5D76BEA7228D58BD448E1D1CFE024733CFE23C09BD1A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302383, "uuid": "554cf971-2103-4c61-bfad-e0778dee6f2b", "value": "1536:85rYLF7QuK0CWYXp7HEj9P9nouy8HyVOdhuNzxfFHPc8c13+GNh:PJ7Yp2PoutfdhuNzxtc5+GNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302383, "uuid": "2d264b06-08a2-4701-8700-529c94ad7d1d", "value": 60432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302383, "uuid": "8a7e9737-6288-4390-9b06-e49eed32dacd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302383, "uuid": "e3a36b86-ce55-4108-a869-6250a7ceabc1", "value": "25eff78a8356ada08e1d605243fb2418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aa50bb-d2d0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624307809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307809, "uuid": "069a54fd-a8f8-47c0-a371-64f9e83fb288", "comment": "Malware payload (Mirai)", "value": "921fb812af9b9e48e4d7cda349d8da22", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307809, "uuid": "dd003d5d-4ecd-461d-a4cf-989b0a9b3a27", "comment": "Malware payload (Mirai)", "value": "87adf3b05a94ad9b789d2b8b49c6b0b1b13c0f2834a1996e5b05bae887e4583f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307809, "uuid": "a6ddb533-b28e-495b-aa57-73f8a47d8169", "comment": "Malware payload (Mirai)", "value": "20bec05a190d720d706629b87cd63855d8b4f05a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624307809, "uuid": "a23a36b3-9635-4524-96a5-2c10f4ae5238", "comment": "Malware payload (Mirai)", "value": "a6bdf37b2c18e1f8a1965ba5ec70dff9f8e7de1c2c11dc0f8247b6bc8dbed1f2487e5607f9417e34cc2669f8ed820c52", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307809, "uuid": "87b14507-4716-47bc-8aba-7e4faae40b1e", "value": "6AE35A136A25C73FC14647F11EFB87218623F4BD1B22A30A3799BDB91E025C66E9F605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307809, "uuid": "a5014f80-e28b-4c72-a53d-fdf9ef58f68c", "value": "3072:0ftFsc//SnEB1Y4xIyjt/INDKKuZslv9UhUVlLAQrzKWviyqYlU6MO/yORw:QhxIk/HNu9USVlLAQrzvqYlU6MO/yORw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624307809, "uuid": "e089fa97-5981-4c11-9f82-cc7230c008cb", "value": 148554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624307809, "uuid": "adbec7ac-9471-4459-9a95-bab6c6b9cff7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624307809, "uuid": "61a88e10-618f-4023-b17d-78135d5968a3", "value": "921fb812af9b9e48e4d7cda349d8da22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f0ea68-d23d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624244503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244503, "uuid": "eca8701b-abc4-400a-a22d-7fb65d553a1f", "comment": "Malware payload", "value": "8cad0dc7dfec8559ca167d14cf7905dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244503, "uuid": "8e448db2-a9e7-4b25-91b1-c08a210f2aee", "comment": "Malware payload", "value": "88bc64b97a6107f2bf90a91cddb292eadd083074ad090bc5ba4796980e7bb194", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244503, "uuid": "12232990-6b0b-424c-be74-46ca4080c70d", "comment": "Malware payload", "value": "a2d233cccff5c6bbf73813f8e34980520682c028", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244503, "uuid": "8ea66c82-388e-4185-9e69-b49cf7c8298b", "comment": "Malware payload", "value": "da65af94222bc319c5ad9c2509fed97ffc38e6060456415d6d8a49053e86bfb96a07084f0dafd59a769fc19af73ec9c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244503, "uuid": "e7fb75a7-442e-4ad8-8780-f8cf1b8eb58d", "value": "DE32D19FEED39E78D5715DF60B575A3078FF8B24EF2C19B9985134884B5D808502D348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244503, "uuid": "8100d043-ac19-4c4f-a4a2-5b42facc796a", "value": "192:0JUo2TjiSlZwhEeoCg+8J/3s0IreBf1fp66NllOiaLpxmoJPvbvvABsAXnvdMMbJ:0Fin4W7Cg+A7DfnflQuAcBsA1jJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624244503, "uuid": "879fb587-c4c9-4869-998c-035f6debe009", "value": 11584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624244503, "uuid": "944eb76b-7fc7-4119-839b-fa8e64db6dea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244503, "uuid": "4c236c5c-c3f9-46ea-abd5-74b1219a6dea", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fa14ba-d232-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624239966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239966, "uuid": "6fbc8bb0-013e-46c1-beb6-2ad7b61517f6", "comment": "Malware payload (Mirai)", "value": "184d451bbb482eda36afd490c957b171", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239966, "uuid": "4ec1b770-6515-47b9-91c5-152c413df638", "comment": "Malware payload (Mirai)", "value": "88c2b2588e63d942d6ab5bd0a6786727cd8cca90f6e5d93d3d1424dd1b55f5b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239966, "uuid": "b9eec33a-95ee-4da4-a6cb-ee76bd9cfbb4", "comment": "Malware payload (Mirai)", "value": "4137c42ad54037f6285c97c38991533ba7379119", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239966, "uuid": "5cead239-748f-4e54-9669-c0b85bc79369", "comment": "Malware payload (Mirai)", "value": "b7db6065fa7c0316151d503d7c642fd79f950407645feadb4f1cdb12292393ce8f06c4169577acd62806cb6e6225bd76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239966, "uuid": "b3d7fbc6-ac26-4a33-92ac-a772976df480", "value": "EDD35B46EB06CAB7CA430BB502A7973A4771FD3A09278F49EB2C6CB897135C8B117715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239966, "uuid": "7f8d9ab7-93b0-4668-8aaf-ae163de56979", "value": "3072:uZ4EEUgF5EznDw+w1AjSwGCqKm9ARzRvhDlruMPZRV6D/A41rz:umEY3BQGCqpaRzReMPZRV6D/A41rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239966, "uuid": "abf10886-7966-4926-b940-18f60620d7cb", "value": 130556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239966, "uuid": "e6b4dbb3-21d8-4ce8-8766-1ae61987e91f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239966, "uuid": "e8dddc48-be2e-4dcf-8418-ff0f5bf7c4a4", "value": "184d451bbb482eda36afd490c957b171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58f7ceb-d28f-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624280103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280103, "uuid": "6fb48347-40b1-4fad-ae51-ee50b8f2bc80", "comment": "Malware payload (GuLoader)", "value": "625e04c374462ac392aa3d57399c5a55", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280103, "uuid": "b9c4b4bd-2cc7-4b4c-87a8-c36c6fce024a", "comment": "Malware payload (GuLoader)", "value": "88c483809135c4c319f872712283c1817b5da969c071cf8f63c80bf3d79c4d49", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280103, "uuid": "a2f5918c-3f32-4864-ac3a-f4ff51269b35", "comment": "Malware payload (GuLoader)", "value": "1cf47f3ec9469c275928c4ff36f5cdcfe091903f", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280103, "uuid": "c93582c6-c5c7-49a5-9501-c600f9af6ea8", "comment": "Malware payload (GuLoader)", "value": "3126ac5c390c3dd2b8d35f3651c4f0edcd02d41b7cde79f2cc424c9504508eb0ce89ee41d9a678af436f488ed01ed9dc", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280103, "uuid": "fa329f86-67d9-4a1f-9935-06908c2a2a1f", "value": "A563F232479EFC128EEB61344744797E7AD84F6522BCB52FA0EC55A3C73E0B04976590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280103, "uuid": "be68ebea-4647-410c-83e7-00295a2629a1", "value": "1536:pvtF6biPRkMOkpGZ2qIgozMBJZ8PYlrJT0YN9Bw:pRkMOkeL0+JZVFJT/N9Bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280103, "uuid": "ff9ba8da-6445-4ad2-ad7c-36cc50ae63db", "value": 68325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280103, "uuid": "87a6bf75-b0e9-432a-b268-80ab503dda73", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280103, "uuid": "48caa9f0-2938-4898-a132-a980e9d8b52c", "value": "Shipment Document BL,INV and packing list.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfd0bba-d295-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624282559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282559, "uuid": "9af13ee2-5160-4696-a491-66d584b9dc1b", "comment": "Malware payload (AgentTesla)", "value": "bd0c51bdd40ac45ee0c1a35ac76e6809", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282559, "uuid": "edd25249-a2ad-41aa-9496-0eba4c6bf3c4", "comment": "Malware payload (AgentTesla)", "value": "896c97bf0d43e0d64b54e807275ec41cbc689c0706092f6a94cf3d620709a621", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282559, "uuid": "0eba602e-d0c9-44b9-800e-0ccdef0fbd98", "comment": "Malware payload (AgentTesla)", "value": "4c736a5861a4915b255964ec37a3c15fc7f4039f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282559, "uuid": "eb3917db-7f70-4722-83e9-216100901ec4", "comment": "Malware payload (AgentTesla)", "value": "eaaa1d0219ceab662b342797dcb07ef2d894f149136130c07b1a15a20a974bf556792113286d520b114cad13401f6138", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282559, "uuid": "75ef3326-af97-405c-a10d-2d6dd955efaa", "value": "A14512C6BA46C2E3C495A8F339924DA5DBE76D1526A8883337B93E4CE03237127F4315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282559, "uuid": "e7fa42e0-3077-46a5-ae32-ef24064d6305", "value": "24576:rh4ZJtKgji8C9mtPrAf+ZZCTl7ynTO//5N5Z7/kGmGH5e:rhkJ5i8pVrc+ZZCT5w4ZzPbH5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624282559, "uuid": "6a2c441e-7236-482c-981a-44935bd1c0e6", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624282559, "uuid": "3454ad7e-dc59-4ee8-9708-3fa8e500dcf8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282559, "uuid": "3d2078e5-32e3-4d44-aeb2-9ee4354bc1b1", "value": "Enquiry Order KV180621.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8524fd6-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303220, "uuid": "6799dc90-0aa8-4b6b-86a7-a47f3d65cf38", "comment": "Malware payload", "value": "13731c9cb360c300137bcb1779267f41", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303220, "uuid": "b2872114-d03a-444a-8124-bf3e8b7d9f4a", "comment": "Malware payload", "value": "89816b893e66ff5eb9a42c14a2223e451e178c944438365ccecc9a8d1d64e6e8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303220, "uuid": "4b8b21d9-c596-4dbf-99f1-a8ee2ef0a7d7", "comment": "Malware payload", "value": "cf816dc25baf65c92550452e3abe7f871af7f55a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303220, "uuid": "4fe06ad3-c8d2-48e7-ad33-37e4159990e8", "comment": "Malware payload", "value": "a61cadeb8dfbf05a5a2e411b069d2d5548464b3cd49c904975a90a085b1790b26ac0ae5caf63301037fa49e7a64d6c72", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303220, "uuid": "8db4722f-6b90-40c6-b734-bbba177b30df", "value": "F233C018F112CC60EF2FAD7869F950A076A706F8F3A05CD26854A20D4DB116D8F677CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303220, "uuid": "df511a5b-7108-4ee5-9b74-1792665945ae", "value": "1536:/tTQJYJQIOf7SieU6ZDvxjxcpAr/USvhWqSOUg:/vWSiebvxju4/UchWBOUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303220, "uuid": "0c285dba-5a65-462a-9e40-1b77397f8384", "value": 51177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303220, "uuid": "955f3a35-6eb2-4293-aa57-baf1b3767544", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303220, "uuid": "842fbc2e-2c28-4c3a-9c47-3f2c8f369a83", "value": "ordain.06.21.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223feee5-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624258301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258301, "uuid": "025393fe-8c80-4bad-8b85-490aeb599b4d", "comment": "Malware payload (Loki)", "value": "706dfb78f5a289694a4060e4cc7f8c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258301, "uuid": "6e151b37-b1e3-45b6-8203-1501d6e39e6e", "comment": "Malware payload (Loki)", "value": "8a91e2138a9a4052ae32d94ea0a88a0fab4028ed233bdcb6ff8d079882ad6e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258301, "uuid": "85aaf1fb-eaa7-421d-8a61-e631946dda85", "comment": "Malware payload (Loki)", "value": "cea2a0046f6c150b249ddde9c74c876a75b34021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258301, "uuid": "e48b79a8-3511-4c25-aeab-67c454c8426d", "comment": "Malware payload (Loki)", "value": "f2bc26922c073fc08889fb3a2b48782c5a92b93291e9b15174d187c002f40a6cb0991c384e9e99afebf7b0f421073368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258301, "uuid": "0250afbf-f9c1-44fb-82ea-de97350d0fec", "value": "19E4BE3039EE610DF577AF781AE436E2967BBE677B07D95C24D4234A4B238428F40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258301, "uuid": "a006bb5e-9830-4d47-9af6-f10666fb1198", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258301, "uuid": "f1c15eee-8e76-4453-a3ca-88f07963d0c3", "value": "12288:E63TnWFHmsfDxOJ8pJqCDQAQ4shhyvU3AqsbklMPWG2xsHhU:Eg4HtDxOJ83qo9Q/Qqsbkln9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258301, "uuid": "7a9b7a47-39a6-4052-b4ae-3009c46ca175", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258301, "uuid": "976521ff-4ad6-4511-92c0-265a2e12cdd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258301, "uuid": "b0a3c37f-799a-458d-9c83-00e26e792e6b", "value": "BtLe7XbewiWhuoD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009de998-d2d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624311073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311073, "uuid": "af83f4a0-9581-4b59-b1da-f02fa98405dd", "comment": "Malware payload (Mirai)", "value": "c0aa1a421751bc331f9b0259f9acf372", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311073, "uuid": "e2d5959c-eecb-420e-bfca-60f5f1c0de60", "comment": "Malware payload (Mirai)", "value": "8c191f70b31e1898cd0feda15aff5e37b29a3657b71c9be882263f56d340ff22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311073, "uuid": "cac157bb-a372-4990-b6e0-875cc101cee1", "comment": "Malware payload (Mirai)", "value": "2b05e20fd6a300a994f5a72f68fc8e58c6b49598", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311073, "uuid": "4086bc54-ab04-42de-b799-302751fc69bc", "comment": "Malware payload (Mirai)", "value": "f6b84dd124035259bee55965f651a935ac3a07e1768c6a481e94b5d99a204f4f713fa48d364b478f26dd5a1f5dd42564", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311073, "uuid": "3a9fdc77-ec91-46c7-bc58-8335487e02a3", "value": "9FD35D46EA818F03C4D517BABAAF41453333A754D3DB730699285FB83F86B6E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311073, "uuid": "7e36ed7f-a6a6-4451-a445-0978f0cd68cf", "value": "3072:a/k7duzxpD1SUHRNZ0tEEZGUcLv5ipPgCpX1O3M/9NK5DNn:ak7dulpDzREZGUcz5i5X1SM/9iDNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624311073, "uuid": "7660feb7-6afe-4175-ac27-67a454413471", "value": 135341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624311073, "uuid": "086fa5f4-c384-45f2-b617-fe2218f0fedb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311073, "uuid": "0eb70b7e-1247-44a0-a39f-58589a408ef2", "value": "c0aa1a421751bc331f9b0259f9acf372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a61446-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624258593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258593, "uuid": "9192ad7c-60b0-4da1-ae79-3a337d6a22c2", "comment": "Malware payload (Loki)", "value": "077eaa9f3f518737a88d537e7879d572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258593, "uuid": "a7d148fc-735f-4bd3-8912-febe05ba3901", "comment": "Malware payload (Loki)", "value": "8c1be0c0e3f9750099ea5a88755c59d97265324a2656ca6ab85393f2eaec1d4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258593, "uuid": "a7368273-8b6d-4abe-820a-659f7f872174", "comment": "Malware payload (Loki)", "value": "8c19092201175ba1e1d046fa9c413cc5d17862e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258593, "uuid": "2ca752fd-6085-4750-938d-c1a195b38a0c", "comment": "Malware payload (Loki)", "value": "43f3c6067d60757b68149bb86bd3620380357e71b7d617841b9498752c03149ed5fe7c473345a8f5abdf1736ae73b537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258593, "uuid": "5dacc71c-91ec-4e56-80e4-5f806d3478c6", "value": "82E4AE7039EE621DF57B9F781AE036E2967B7E677B079C5C24E4234A8723802CB41539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258593, "uuid": "ce4e609e-8b10-48c6-8a33-2859f1dc8da5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258593, "uuid": "bda3c8dc-2192-4ac7-bd09-000cc7be3490", "value": "12288:JkX0uWFHms8dBVNTxoPDA2wemYUu8w/q684BglrFTqZtEkHhU:J9NHmdBVNTxWwPey65sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258593, "uuid": "f8732590-cffa-4014-a3d6-0ff0f009eae7", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258593, "uuid": "27c9ff84-ebb2-4cc3-84cd-90b6e501a898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258593, "uuid": "0cd1057b-eb8b-475a-967e-09ccfc1b075b", "value": "Purchase Order-020POR040557 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6366f4-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284168, "uuid": "6d4962be-9498-402f-b9a1-1d8a8609f390", "comment": "Malware payload (Gafgyt)", "value": "2221da46893a68776bdb3803f0c7d87d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284168, "uuid": "0eb78b5a-5457-4211-8e4e-af3cf27a9e96", "comment": "Malware payload (Gafgyt)", "value": "8c55851ca920533baf36b529bc0dde320630234f9e2f10395be7c4262e03d3b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284168, "uuid": "3ce3a6d1-5a13-4018-89d1-08b6932c62b5", "comment": "Malware payload (Gafgyt)", "value": "bbf59456e612a6f56b46826abcf8ac5e0431f509", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284168, "uuid": "60abd201-3362-4bbc-935a-05f42e37647d", "comment": "Malware payload (Gafgyt)", "value": "baf713baed403088617cb57d8b9b6c2fb5df7e4f9c7918005980da1f741c5e39946697cae2bafbf641090927b38969f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284168, "uuid": "605ab4ad-5e4f-4aa7-8a99-15326497f50f", "value": "99733A02E643CAB3D8831BF606975A650A31FE2A4E2B9F49F31D7CF4AB124C87117765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284168, "uuid": "7faee001-24cc-4701-999a-ccf5e4a06ac0", "value": "1536:TK4MquPsLoPWW+zstB5/1XGEiaC6HkQ/nkXs3pVO6IQ6jOD0:SqNcHNtB5/BTiKkqkXmpVO6Z6jOD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284168, "uuid": "7dbbf39f-1602-42fa-9f37-80c938c75ea7", "value": 79081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284168, "uuid": "3e08eade-1d67-43ab-ae2b-273a0c2b288c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284168, "uuid": "86816dbc-a918-48af-8a7e-96468f01ab6f", "value": "2221da46893a68776bdb3803f0c7d87d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06666361-d2bd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624299486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299486, "uuid": "82e576ae-aeba-4f85-b327-d0eed69a76f1", "comment": "Malware payload (Mirai)", "value": "2c85f5dfbb09cda41477f0d45434728e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299486, "uuid": "a094ad64-78ee-417d-844c-733b821d87d6", "comment": "Malware payload (Mirai)", "value": "8cece08a6dcc13e02def8910ef3c61e6494b1b98fa946bde5e45a893d8e4e03f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299486, "uuid": "27090864-0a64-4976-9e14-81d6e1753712", "comment": "Malware payload (Mirai)", "value": "64c336b002d6b697fe98a7737665111eb893a230", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299486, "uuid": "caaa15d7-ef2f-4223-abce-76460606b9cf", "comment": "Malware payload (Mirai)", "value": "14d8f9eb23154a44d9e7f190471df9abc6c4bc2701efe310144dfede06bb76d5f988b5276c9cae909c9019fc6c707b9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299486, "uuid": "63da7440-b062-4eb9-930c-4166790ad77b", "value": "9F333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299486, "uuid": "c9a03010-548f-4807-99b3-0fdd6e2cfdbc", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380Dp:dsfIBZeNlJDFj0imvppqmUJP6Lc8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624299486, "uuid": "d46feba9-7778-44bb-a75a-aa69e40d34da", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624299486, "uuid": "2f3a6e21-f30a-4fb2-a7bd-e86852935277", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299486, "uuid": "e09ea6a7-03de-46e1-9df4-bbd145f86969", "value": "2c85f5dfbb09cda41477f0d45434728e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8186de74-d28f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624279936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279936, "uuid": "ba2147dc-047b-40fc-8ecd-0ddaf0053703", "comment": "Malware payload (Formbook)", "value": "4af80e0a98d18461d13cda783f959ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279936, "uuid": "9a67891e-8b23-4de4-b656-54704a4f6e82", "comment": "Malware payload (Formbook)", "value": "8d45c54297edec973add090c8e620ecb9cda7d7ae2c24c00d77a4361f8026eef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279936, "uuid": "124a34a6-e30a-44fb-ae03-0870dc036047", "comment": "Malware payload (Formbook)", "value": "198237ccbdb35c1e59ed590794b180c00b52afb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279936, "uuid": "1b772c20-ca46-405c-9203-c6058974845c", "comment": "Malware payload (Formbook)", "value": "178adfd750e2dcd99c11e2bfea2d487847c3685a31624075cb4dfb83950d1d7585e55111badf60de574eefa681402440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279936, "uuid": "50e9c1cd-e076-4e7c-9d57-f7401e3af166", "value": "6325AE5AFB457FE7C21D0F3AC01B066883E181276273F3AF6DE215E46612B169B2F056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279936, "uuid": "6dd435b4-2c9e-4a4c-998f-0e06371a4cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279936, "uuid": "e5b1b9fb-1a20-4d85-89d4-478dfddbc371", "value": "12288:TyOSnbvGfHH7Kil0hp+wbBQkjVIamSVQamSVkbiEec51a3U9wieqsd6TvLLdmjsq:mOSbv8cVIampamTec3R2qskTLooBCKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624279936, "uuid": "51ef9615-ffc4-495b-a656-c99560188ff4", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624279936, "uuid": "43c43519-5900-4b4d-86bb-006eca88d7f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279936, "uuid": "20ba3a11-e5c3-4fad-9716-0d323041a2c6", "value": "paw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b1937b-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624259293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259293, "uuid": "6d8eca0d-6540-4650-8802-d62f84fc12eb", "comment": "Malware payload (RedLineStealer)", "value": "b99a908cfbb37f65dbd75670b3410e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259293, "uuid": "38356581-ef0e-4c38-a64e-85dbf95d0a9f", "comment": "Malware payload (RedLineStealer)", "value": "8e3f7d2edb98e0db11da5c80509ffae771f7d0148c333250b68e5f5c00673ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259293, "uuid": "b9379f71-90ff-4214-80c0-55d1258d6544", "comment": "Malware payload (RedLineStealer)", "value": "728f8738cc1aee6346c8d8ce48833b00655e79fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259293, "uuid": "49b16746-e3de-47d6-9aa5-94526a0c681e", "comment": "Malware payload (RedLineStealer)", "value": "e80c36759988c56416912dc80c59480d9fe5aaa1988755df3485a38a0de005b2d57f9da772179126555364244774f4d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259293, "uuid": "9ed9079f-6910-44e5-8b54-fff514ef31f4", "value": "9D94BF10FA90C035F5F766F85ABAD3B9A52D3AB0972450CB52D52AEA1B347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259293, "uuid": "91b99087-1942-471d-8365-5d58348290ef", "value": "cef982a39394466fe74a88f9214df2fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259293, "uuid": "0510b7a7-77a1-4b9f-b2b6-93695f23f541", "value": "6144:8kWMcIy/ecrsp7SjNnN1HQMqvIdImN/Ra0FRFRhZ66WidRN+HT4s3Kri:Vc9/ecrsp7SdNmZ45AuRE4+H3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259293, "uuid": "da9b2abf-55e7-4c72-a075-e6a73e50472b", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259293, "uuid": "370083ff-3f05-4627-a9f8-2b427b2aa516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259293, "uuid": "762db6e9-5221-4b10-ad44-dba9fc00cdbf", "value": "b99a908cfbb37f65dbd75670b3410e0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3712dac-d263-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624261095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261095, "uuid": "c56c0401-6c72-407b-b969-09ed898cf2bb", "comment": "Malware payload (AgentTesla)", "value": "3d9c9fa8aa83f7bba525b6a2f5b80a17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261095, "uuid": "6c5751fd-040e-4c9d-87c0-0c52746bab7b", "comment": "Malware payload (AgentTesla)", "value": "8ef7418280178477553b2c62ef081e2ea1e78397075cca986e9527d9073a33f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261095, "uuid": "e8468ac3-af72-428b-a542-942f442a1387", "comment": "Malware payload (AgentTesla)", "value": "29c3d5702a4f16494986fd27f695b8fa84cee755", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624261095, "uuid": "eba792fc-1dd9-401b-aa11-21d3ad960f11", "comment": "Malware payload (AgentTesla)", "value": "f9958f9426373e844ec3b313ca25ed7d1b14b5d2a27f7db9f9452eeeb3f3110afc5b437362bd9a895adda0a35f7dd5b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261095, "uuid": "5ec9f7fc-1423-4ec5-9651-196a04183a40", "value": "D8F4BF3039EE6209F5779F781AE436E29B6F7E677B07995D24D4234A8723802CF40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261095, "uuid": "1567c6a9-473c-48da-8f2e-1e35f7b64f39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261095, "uuid": "5e1f9d28-12b3-4a66-84b6-92c4c40ab972", "value": "12288:jdwhCWFHmsDaUcY+A/ZnQCOb2z6Qbqz1KhMc6QCoR00OlmEzYvCl5V210TbPTIHq:jo5HZaUcYhRO+1k1dc6Qn0NlxgC7V214", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624261095, "uuid": "5ffba0ee-86e9-45fe-b0e9-aa6130d1d29f", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624261095, "uuid": "06d2cae4-ae5e-4da1-87cf-cb1cffac8aeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624261095, "uuid": "3ce0bda3-a1de-476b-a4c8-9977d1d63c29", "value": "3d9c9fa8aa83f7bba525b6a2f5b80a17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b79d9b4-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258880, "uuid": "0bde9b0a-3489-422d-b67a-6ddc2dfc50a0", "comment": "Malware payload (RedLineStealer)", "value": "93b95935f22b48cf9910fb1647ad6a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258880, "uuid": "3c07a21c-f1b6-41f7-b846-99b606f475ea", "comment": "Malware payload (RedLineStealer)", "value": "8f505de01044f7c78890ea859ac813af388145086cc3e84719913eaf53fd2d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258880, "uuid": "d2d5279c-24bd-4fd1-bc7b-1b3e0a25f4de", "comment": "Malware payload (RedLineStealer)", "value": "cff2e82a2e9400e29ac5dce438c64ef58eeeb8e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258880, "uuid": "1c300980-c391-4e0b-8c42-3c20f95f9eed", "comment": "Malware payload (RedLineStealer)", "value": "91f84286612f9cc798ee3e9559722d455239bec252398075dcf57a1b89a7771330401b0a2ac3a6fc6509b742be7ce1ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258880, "uuid": "d1a4d78f-12ec-4805-9e03-d11ddab11ba9", "value": "E194BE10EAA0C035F6F752F85AB593B8A93E7EB1672490CF12D516EB1A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258880, "uuid": "90fdaf70-a907-4731-86c1-a64a87532bc2", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258880, "uuid": "7fad1cd6-c81a-49d1-a551-e8b5d5bc5e38", "value": "6144:0dKEVI1lHk2guDvSTKppweqUUK9DhNyG5QZ0hGaubQPK2H4uKriCi:CVilHk2gu7S2p7qURhh7Ptpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258880, "uuid": "a0ad1ee2-8269-4aa2-bd75-ad6a33c71bdc", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258880, "uuid": "9c12ff9e-64d9-45b3-a598-25260f52ad69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258880, "uuid": "ff90d01a-4755-4ad6-a97a-59108613346f", "value": "8f505de01044f7c78890ea859ac813af388145086cc3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d45c385-d268-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624263044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624263044, "uuid": "37d4e88b-e067-42da-94dc-8aebdf9f202a", "comment": "Malware payload (RedLineStealer)", "value": "3945aa58418cee7e643ebdb720091047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624263044, "uuid": "e6bac287-61c6-4ab9-b1fc-519a082a0ee2", "comment": "Malware payload (RedLineStealer)", "value": "8f765c865c2b91484e47d22537314a9091ffa80683fcb191b2230dc388321053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624263044, "uuid": "c56c9eae-8a0b-49b0-8a7a-26aec7bd35e6", "comment": "Malware payload (RedLineStealer)", "value": "f44568a9902f17d0c1efe624c28dcbcb53aeed0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624263044, "uuid": "72fb9f32-8572-46f9-a2f5-4138523702cd", "comment": "Malware payload (RedLineStealer)", "value": "ce31b0ade11db6aa0831555aab38f3f1f8415f0f0cfbb9f6c67f1cd6020b05daeff13f63653f6baceb5703440bee7978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624263044, "uuid": "e4a38976-d13f-4ea5-9aa7-db70a03b70d3", "value": "BA84AE11E7A0C035F2F752F85A7693ACA93E7AA16B3450CF12D52ADE56387E0AC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624263044, "uuid": "b206de88-bc55-4d03-87ba-521273efffef", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624263044, "uuid": "d4d71d83-6e9b-4482-8fe2-2f5a726316b0", "value": "6144:9oVzdYlAkouhN43mfFpBAVMxTdYf3j1d7V7d43asNKrifBz:Yzd8AkouhN7FrAVMs3jz7ItlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624263044, "uuid": "5ebac76a-5fc9-44cf-a9c5-6d0c6965865f", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624263044, "uuid": "27f72b37-b02c-448c-92b9-b67608f45fea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624263044, "uuid": "7f955c8a-2900-4d06-8f97-5612b4efb39b", "value": "3945aa58418cee7e643ebdb720091047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b21952-d233-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624240296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240296, "uuid": "f48865cd-f2c9-4c1a-9f3a-27a97edad1e3", "comment": "Malware payload (Gafgyt)", "value": "0fddc729d55ffbe9dc01913f584499b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240296, "uuid": "c2e1c627-6468-49b8-a5e3-a4a07ba3fabd", "comment": "Malware payload (Gafgyt)", "value": "8f89d4dbbf114875f412812c7b6f9a506911a9267e1a0d59aa7fe369e88940ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240296, "uuid": "4a32a378-b48e-4f68-90d2-be4d3de242ce", "comment": "Malware payload (Gafgyt)", "value": "d36ac6caed681816c3b48e7e42c125eb8dd41a9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240296, "uuid": "746d943a-ceca-404a-9099-1e847ee045af", "comment": "Malware payload (Gafgyt)", "value": "b010525a9ef166ce886397f4ace1b63f91fd03063d49233a4976b2023bb9f269f56dbe7f2b7f32973989a9f50a232c1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240296, "uuid": "72bcc6eb-ef6d-4323-8b0a-9c45857aef43", "value": "CE2301E39D01E2B38C74C8B7F3EA921556B41EBCD36B21A2233108B0C6E75C15F6D962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240296, "uuid": "72cf024e-0d9f-4cd8-bb41-669ad1416d8f", "value": "768:U5yr+eFAz120bnh7Wkb2oqYpWZfb73KoRBC0tPq3U79ovDOnJ/3:RfFAzkIYBRYkasdtTC6J/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624240296, "uuid": "c88aa261-328e-409a-807e-2e50b61705a9", "value": 47052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624240296, "uuid": "1a4bb7de-8643-4732-8ccb-40e153a391c3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240296, "uuid": "c0eae5c4-d840-4d2c-b397-806e3f35d473", "value": "0fddc729d55ffbe9dc01913f584499b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661c5b8c-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303512, "uuid": "f528eb12-6394-4d60-90ca-e05d05667145", "comment": "Malware payload", "value": "87b0ecc63bc1f246c6f844dd87b77c4f", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303512, "uuid": "b1221344-5da4-4ec8-ba15-bc447530a3f4", "comment": "Malware payload", "value": "8fd99c19c5f04b332c6b8333e84911b70f43ea0d2840fd5b7602073ec0546d23", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303512, "uuid": "7b7d333d-8689-4c98-a90d-ef9c58b34865", "comment": "Malware payload", "value": "2709d1fffbf37cc0ecfac01a8e2f940c714567ee", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303512, "uuid": "723ef64f-f6ca-4fac-9fab-b05781b51ff1", "comment": "Malware payload", "value": "05f4fc305f556978ab0031465d418e00a313e5c632762d3cb760f1f611c4735883e6ec01ff104f52129396301f3bf88f", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303512, "uuid": "c6e25b1c-24ff-4008-bb8b-90c7d9179189", "value": "5A51978E3CA25DAC07335861DD2FD849E83886206791E45DC5CDEDC32DA03E88B5697B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303512, "uuid": "d0682c7e-c177-48de-b26a-d32cd0240913", "value": "48:IPapQoS5AUjTcMbWOEiUIdLgXacg1CTtrLNBi8GWDNU8Y/2c99pPylJSlTknhozB:VRUjQkKIhgXaJati+RU8Y/2GAOzbCdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303512, "uuid": "64e788b8-93d1-46cd-a174-8a70eb08a912", "value": 3026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303512, "uuid": "186f8986-9e45-4807-b048-f9f0bee85776", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303512, "uuid": "73620c6b-74db-44b6-acee-35fbaa36c5c0", "value": "lngCopy.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dbb103-d2ca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624305224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305224, "uuid": "fd7a7eae-8bb6-49eb-a26d-68c8c194e557", "comment": "Malware payload", "value": "90feca61ad1a2de0454fc58d93bb5ab6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305224, "uuid": "50815d21-d443-45d7-8efc-be4ac8fb27d0", "comment": "Malware payload", "value": "901782479cf975a8b2811264fd34f2e6fde694dcb968ce8bf502cb054ac9eb5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305224, "uuid": "903c81b6-427d-4f41-858c-fd066608064c", "comment": "Malware payload", "value": "f4e5e965dfcbdb5adeb3e172694eaa0bf209198b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305224, "uuid": "051a4115-11c6-4538-95cd-0e17d3910320", "comment": "Malware payload", "value": "c85a1113895c05a188f62b9659b64760b1087fbf5e7c24fd28cff5c6840a3f078e4a971c71db56f0db9501321c333a33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305224, "uuid": "21e51871-b2e0-492f-9cfe-05a34f96b0d1", "value": "F304D026E2E556CDD24716771319B3373214F42A42FAD2A3FF2CDAD2C097AF84414D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305224, "uuid": "ba40fb98-a520-4b8c-902a-2f9cfa68480f", "value": "14c75779b7b4d62acd0d37b3afcd3c4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305224, "uuid": "889120cc-6769-4937-9a93-884848b263ad", "value": "3072:1ZUVAk9rsXo3/Ifz/uUXF2mSPBxv1tM7lt8jPU6/pyagsuAtuUucGZ2:1UAk9I4vgz/V2dulz6/hvHhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624305224, "uuid": "671bfa56-ebee-42ce-86bb-7a9f5d9bd4c3", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624305224, "uuid": "c5632e49-1d64-44c4-8597-0142100bf949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305224, "uuid": "235af79f-4d4c-4b01-8158-5833d5c89603", "value": "90feca61ad1a2de0454fc58d93bb5ab6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18eebf8-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624285224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285224, "uuid": "e2c63ada-2e8d-426f-93ef-53b4d24ea67b", "comment": "Malware payload (Gafgyt)", "value": "bdaf8b58b738daf8586f3f6c56452915", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285224, "uuid": "db4dc1d7-26fc-4fd1-8f99-866aa0d16e1b", "comment": "Malware payload (Gafgyt)", "value": "91650ba26394de59c53cd85a8c063a2632874d3339fdf72025441125a4623337", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285224, "uuid": "f56c2fe9-9d0a-4e82-bd6f-57cfccdbba3b", "comment": "Malware payload (Gafgyt)", "value": "18789df26e42aac0f10a02331ed4ce885c1fb8af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285224, "uuid": "7dedceb3-479d-4ac3-8e77-5131ff0163ad", "comment": "Malware payload (Gafgyt)", "value": "116764fea0e98b42ff68c6fbfcabf41801ff7407157d813e7f4ef7847bbdbfbf2e42b89376fbb91b7adcee166fc643ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285224, "uuid": "a94e2984-d2b1-4b4d-8e81-64cce6308089", "value": "AFA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285224, "uuid": "7009e51a-ca82-4fdd-aca2-7d04f79d6f7a", "value": "3072:VSx+i6mqaObhNXnPNKV+qKmZuqQ4DPwXXtse:y6mRObnXnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285224, "uuid": "f9b59253-e307-48e2-a609-80905c54da22", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285224, "uuid": "9ab1dffa-913f-439a-92a1-19f3ac0a84c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285224, "uuid": "47b5b619-2e8d-4874-9551-c9b4af40dfc4", "value": "bdaf8b58b738daf8586f3f6c56452915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106fd071-d28d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624278887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278887, "uuid": "6d5b7998-bb88-4455-b203-39c33f31ff80", "comment": "Malware payload", "value": "e54e6d58e140cc8f602c56539b6966eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278887, "uuid": "667e7fae-97f3-47b5-835e-62f4881b2ff7", "comment": "Malware payload", "value": "923b8b02405ac34a65c3c349fe2a5afa55fa301310b2223f4fb57833e9883cde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278887, "uuid": "649502a6-bb66-460b-ab7c-a5291e3ed319", "comment": "Malware payload", "value": "e8f6eede2758d47523c9182c202b33a90182675a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278887, "uuid": "85786880-d712-46ab-976f-7f35618b93bf", "comment": "Malware payload", "value": "8ac1afc8ddcb3ff62e5e929a8094e57588fefced4b9368854ccdcca2550e614c3ec1fa0182e418f19f842a06ac46d1b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278887, "uuid": "46a0b51b-6f4a-4761-a768-d9a2532f6075", "value": "6DB22A82AA83F9F5F824C7B5D837AB727372F42F2459ED96DB5B1C34A842001D25329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278887, "uuid": "41867586-9b5a-44ca-89eb-507875cef969", "value": "384:fIDU0VIjqfLKKor1aKMztkxI9489HdTwLvPV5l01yXA1drJq:wDU0qjMKKA/mJbdELvNr0EQ1dro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278887, "uuid": "e1a50d9f-09a8-4c39-b4a1-d9d959b12f5f", "value": 23592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278887, "uuid": "4e9461a2-bd36-4fd4-a4b1-4636337b3a6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278887, "uuid": "61aef456-ecf5-4e62-a3c0-f3845f0f5f6a", "value": "e54e6d58e140cc8f602c56539b6966eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70be97dd-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303100, "uuid": "408fc0ad-134a-4301-a6fa-4f5ab19b7e7d", "comment": "Malware payload", "value": "47e580efca5c42565af7b214bd601d80", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303100, "uuid": "79f81653-5385-496b-9e74-33a2bf114a96", "comment": "Malware payload", "value": "9263854abe5dbe018d02d6dcd445f0346b291c7fe0153aaf5e62a03b3c6defe7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303100, "uuid": "525ca3f4-e881-4074-bcd3-cd186151b43a", "comment": "Malware payload", "value": "aec562dce6460848ee0944e9dbce294d958f438d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303100, "uuid": "d0d9d29e-d962-4031-ae65-bb39cdb973d9", "comment": "Malware payload", "value": "0c4f9f50d7f95fbd37524c4d4adc8bc6bc7b21f1b4cf9c0f666788d9d51a30bb682ff30aa97cf3a04ab34c6232a9e27b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303100, "uuid": "2360e21b-3ddc-4e03-bf9c-7c264484fa7d", "value": "3033DF08F112DCA0EE1FFD79A1F850B076AB16B0F3909DC26C44A55D59F309A8B7B6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303100, "uuid": "1ed10531-94c3-47e9-8539-d7a624311135", "value": "1536:/oH78QIOf7SieU6ZDvxjxcpAr/USvhW7OE:/oH78WSiebvxju4/UchW7OE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303100, "uuid": "05271ee4-8734-4bad-a884-f5d1c3c1f44f", "value": 51645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303100, "uuid": "caa723d6-9972-4c2c-926a-8b5a7ed48faf", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303100, "uuid": "d0ce637c-e552-49f8-bebf-df932ea9f225", "value": "certificate-06.21.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec030da-d28b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624278159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278159, "uuid": "bbe32c6f-c4fd-445f-b99a-eb8f3fb78207", "comment": "Malware payload", "value": "1f341245ccd017f7f0e995b2218ee7b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278159, "uuid": "96aa794d-50f8-49eb-a1c0-5b0f06618f77", "comment": "Malware payload", "value": "93be74baf09a499b5c69a5717c5a4a5c302a3bc757826708e71f033daecc7180", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278159, "uuid": "ff957508-a6fb-458d-a7c3-4160079f8db4", "comment": "Malware payload", "value": "65eb489a90d98c27757aeb2a5feae2327cd86cc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278159, "uuid": "e3f04e84-d9e7-48a7-ad99-bbd51cd55a44", "comment": "Malware payload", "value": "ec6d06732d1c534fba563b29dd83b5f15fa928c165872d80abd91db64881793f9467070adeaa8e77b3c70ccb49ecc4dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278159, "uuid": "73328847-daaf-4235-b3d9-d0f947baa15b", "value": "0DB25DA38A792F18E258C5B4A011CF385753E516E94B2FFE2436C3665043EDEB14A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278159, "uuid": "6150a1f8-b2dd-4c06-b3ee-016d46eef143", "value": "384:f3A4kyyPD21mC/5gGoIfDGHVjrP7RfMT35oJ/NqBAbC5/oFSe:f3qpiVmG7bqVyo5NQZoFSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278159, "uuid": "66c4aaf8-bd8e-4f1c-8b67-4caa61dff247", "value": 24208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278159, "uuid": "7a4b8bbc-c9ef-4dbd-bf4c-eabd591ddbfc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278159, "uuid": "547594aa-6fbf-44c6-a341-ccb86d339142", "value": "1f341245ccd017f7f0e995b2218ee7b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc06645-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284442, "uuid": "9405ddf2-58b5-48f5-a3c2-310372ff22c6", "comment": "Malware payload (Gafgyt)", "value": "f373fa477601b8aaecfee83db122524e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284442, "uuid": "319ae07c-be98-41fd-ba56-e82fa84b1fa7", "comment": "Malware payload (Gafgyt)", "value": "952314a4429eb1eef0e588a4c21086bc73a71f7474e4d3135cbc084b0ece3566", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284442, "uuid": "98c2f953-0f80-45e8-bfba-aa11d0d963d8", "comment": "Malware payload (Gafgyt)", "value": "3a384c5c4c28d0d9a13498e10f98d42408e6ad51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284442, "uuid": "a8b8adc0-2949-428a-ac15-f4b7d65c53b0", "comment": "Malware payload (Gafgyt)", "value": "fa62286201e54323943179d40f617e91ec4dfb51e805b3a5aadd552ebf4bb044e4d5c96665fba7921760404080484de0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284442, "uuid": "4aff91d6-6ee4-441b-94ff-db9ab9018ac6", "value": "01A30896F900DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284442, "uuid": "c756633b-58cf-4345-8a52-ffef45be7519", "value": "3072:nkrWBIvC/IymEdH8ffk6OKmuxVqDr78fz1e:nkrWBIrym+806OKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284442, "uuid": "b6c7d4fd-2b2f-4c15-9a91-cb204f08fd9d", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284442, "uuid": "fa800e16-60a1-4efe-8fc7-fee3b6fb7fda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284442, "uuid": "7704f970-86cc-494b-9f42-0e9587617dc1", "value": "f373fa477601b8aaecfee83db122524e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7dc74e-d23b-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1624243851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624243851, "uuid": "960319b1-6fca-4c30-813b-c24a495a0de3", "comment": "Malware payload (njrat)", "value": "3efecc6d6ddfb3d62fb8e9b6496287d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624243851, "uuid": "8dbdab76-6e3e-47fd-b927-198870fccc82", "comment": "Malware payload (njrat)", "value": "954988371d8cebea1a69f2c1a47d50b13b9eb82630e5fbc5069105bd12b7b541", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624243851, "uuid": "85dacad0-ac9c-4237-b487-80216d74b6d4", "comment": "Malware payload (njrat)", "value": "a6902a8745fccbf86706ea24196c77af4e4bb49e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624243851, "uuid": "21ca5b22-fa0f-4c9c-808f-16733cd2f274", "comment": "Malware payload (njrat)", "value": "22822b7d78801bf9690809bfa76a3b3e2beaf5d4fb405d81497b47c8ffa805857b3f033fe1550e88947263995152cc3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624243851, "uuid": "5d1d446d-1a3a-44b2-bc0c-e8923676ee51", "value": "AEF2B5AA20507158D6E349742C66EC743B28A7325881D14EF472874CCF82AFA79FDDDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624243851, "uuid": "92cbdeb0-a5ad-492f-aa34-edda766d7706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624243851, "uuid": "63423ebe-6da9-441d-b262-6b2e4782ad59", "value": "768:lSDJ7PAyfdIOqLMQCJ8ndxQDqMmJMBsMhK:lAA2ZqLMQg8nUWms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624243851, "uuid": "1176223c-73e9-48b4-bf94-113dd2ab8e91", "value": 37144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624243851, "uuid": "6bf15d9f-c59f-47b0-94ab-b4fb1ac8dabb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624243851, "uuid": "45b9a98b-4203-46a8-92e1-edce39a34799", "value": "3efecc6d6ddfb3d62fb8e9b6496287d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4440e51-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303187, "uuid": "11041b78-9e60-47b3-8904-88ffb0c32696", "comment": "Malware payload", "value": "86ddb37be7e54511c8761308c1d7fa91", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303187, "uuid": "3f354979-c2fb-46d5-89fa-dd5c9fb1aa16", "comment": "Malware payload", "value": "95b98956227a62ff4d290f302c81a095fd6c2fedfd9b15cd7150fbe16f292cf2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303187, "uuid": "22cfa6da-7b35-401b-8f74-a4e214c24d73", "comment": "Malware payload", "value": "1a56b94a94ab4b35b2b6256e571ddb6f28ba06dc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303187, "uuid": "8ea5b3d2-62fd-4091-94b0-3421ff83d1da", "comment": "Malware payload", "value": "a0b78fddf310ca91291cc790c264546780c931de813ce047d5d3d77764a0ea160efb5530d31c97508e8f04c8c719c7d7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303187, "uuid": "a6559e8c-0747-4e1c-9b00-a9182766e298", "value": "0833C018F112DC60DF1FAE3892FA60A0667B0BF8F3909DD66894960D1EB115DCF276C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303187, "uuid": "2e678d57-7440-491d-8d0c-a430ac42d578", "value": "1536:/+T6CizwDQIOf7SieU6ZDvxjxcpAr/USvhWyYv:/+TJizwDWSiebvxju4/UchWyYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303187, "uuid": "217084df-731b-4be3-9cdd-52ed6f386d66", "value": 51262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303187, "uuid": "fded49aa-c780-4389-8a10-9e6d32a508a8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303187, "uuid": "5348fba7-288f-45eb-b854-06802ee361c7", "value": "legal agreement.06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b66f2f8-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624287173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287173, "uuid": "964d3aa0-e28e-4dfe-af51-275a5418a7b3", "comment": "Malware payload (Gozi)", "value": "f6e62cb32013aacca6d75ace2754ea2e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287173, "uuid": "9b65302b-bb81-4c43-99cf-e755b6237b33", "comment": "Malware payload (Gozi)", "value": "95ee30fe8d98ca42ee90db02ea80480154fd5f7c1464983451bbdb699a11ff1b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287173, "uuid": "933d2f5e-c774-4856-90d0-4e72ed9fff12", "comment": "Malware payload (Gozi)", "value": "652c8017fad54c46c6b0a34c3e9b694dd868e81d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287173, "uuid": "7a499a14-b06a-4da4-92d9-2920c13d6963", "comment": "Malware payload (Gozi)", "value": "6e031412c245f81b5b162017485c2f431d5528dbc4721d239bc9a9134fbb6a1032cf3756f912c565bdec9b085bc8a21b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287173, "uuid": "5a48b071-def8-4961-98d7-c223bb59da50", "value": "3615C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287173, "uuid": "a1bbe1cf-7ce8-455d-b15c-45ab97bbd069", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287173, "uuid": "9b339cee-2a82-4114-bef3-bd9f3bd41855", "value": "24576:HQfpzjXPgfg8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgEJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287173, "uuid": "9381ef01-0621-4b2c-9aef-0d869eceb7eb", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287173, "uuid": "40457840-4ed0-4721-a9c5-97e1cbff83f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287173, "uuid": "92ee51c9-68f9-47c2-a40f-882f6337694b", "value": "f6e62cb32013aacca6d75ace2754ea2e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48853e5f-d24e-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1624251923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251923, "uuid": "753c81ab-f001-4e6c-b955-ccfc63f1f12d", "comment": "Malware payload (RevCodeRAT)", "value": "bd35dd1bc38521c4feb42f5ca266900c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251923, "uuid": "5da43671-28f6-48c2-a290-a5d1326d1b19", "comment": "Malware payload (RevCodeRAT)", "value": "968cf1954069babdf367259271ba34fc1e149a18255c45fc8138d0da2b3dd413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251923, "uuid": "098199dd-ccfa-4ba2-a0a5-544aa495f9fe", "comment": "Malware payload (RevCodeRAT)", "value": "72ff48fbd0d0db7ee83e90edee6d90eee6719a57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251923, "uuid": "177703d2-2c57-4042-a4b8-813828f093cb", "comment": "Malware payload (RevCodeRAT)", "value": "5f56ee9e7fd9535c94bb376597995df32fdac78c85083d813533a7005b572c00f0a97cea96edad6df1690eee35aaa42b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251923, "uuid": "0cb9607f-5217-466c-9237-3a11d0319060", "value": "7755E12036E69148D5FF1B318DB9D1C403BA7A673B55CF2E648A224C8D13753DB12AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251923, "uuid": "22d5339a-a593-483b-a0c1-2d8d6bc5cf29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251923, "uuid": "04cbfe12-3d06-4c0c-990f-4415cc89dcea", "value": "24576:+xHSquPHpiwFbzMDh66b/Shc0nz1h37YhIUfv4YgFN:ThF3MDh66DVuz11YuUfwYoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624251923, "uuid": "a24e465b-0c9d-4927-abff-49e493c7c539", "value": 1370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624251923, "uuid": "7c94a3c8-e4e6-4cb7-8695-f4060a83e837", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251923, "uuid": "baef8679-01b5-4f1f-b1df-0b64a4927d99", "value": "MATCH_OUTSTANDING_BILL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519dbb52-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303477, "uuid": "dca1e4a2-54af-4df9-ad94-67baf8bea256", "comment": "Malware payload", "value": "63fb5540334abb309bff6ac61ac14bc2", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303477, "uuid": "b527740f-b7ed-42c3-a3f3-46fd364e3499", "comment": "Malware payload", "value": "96e9bcb0843c25edba92eaa6cca64041314c7874c861c47628356b2aefa33eb9", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303477, "uuid": "f3cd5899-c3e9-4a2a-9174-c1aaacf35d26", "comment": "Malware payload", "value": "52a227e50820fe6bcb75b15c2c892cfe5b404149", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303477, "uuid": "f55cca60-1224-4318-9d61-8ce0227c9978", "comment": "Malware payload", "value": "5896ee987969ba71655857203acdecf8c3a3b374f9215c9a6ea0fe9cca1a16ec72cfb5b2b002e4e37e09cf4d046500a0", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303477, "uuid": "d291d80d-56b2-4658-acf6-270e289912e0", "value": "6251B8CE7C525CEC0BBF89667E3FC5594C61CA528342C46EC8419D86C8406E98E5B6AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303477, "uuid": "c21afa6e-9a91-43c3-9b3b-03997c142420", "value": "48:Vp0UobVu442sZSwQXu43l76et1CTtNzVYwi7YHYx1YL9WM/4b7m4cQ5oR8+WORK:PPob8Jh2XL3lmePazHa1Y5qb1iNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303477, "uuid": "4191bcd8-a172-405e-bcac-7baa1906eddb", "value": 3014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303477, "uuid": "8fb2bc59-b410-4cd1-82de-7e156f264a5a", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303477, "uuid": "4272f0c3-aa9e-4544-abd7-d5e7d4119016", "value": "boxMain.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8c114e-d259-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624256578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256578, "uuid": "650c0c0e-2307-4142-8e36-5fc2cf33de7c", "comment": "Malware payload", "value": "46027b0c1c0ea082d511e287032a8547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256578, "uuid": "dc773a7d-6323-4eb9-82a3-6158eefe1631", "comment": "Malware payload", "value": "972d8fcd3083eb6c81e2dc704d8e0ec1b097e43b7ef5576cf8cccc4e8fc85925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256578, "uuid": "819199a4-c254-4942-845a-e85ca010987d", "comment": "Malware payload", "value": "ea3bf188849f87e84228d82c428852da2a57f407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256578, "uuid": "0fe33521-2154-44f0-be3e-60ffa45eca20", "comment": "Malware payload", "value": "e2d70b39f61d58aa65ac3d74163d961cc44139a0c6c8c8d298864842b134881e88035b4d6b31ee0cc704f57c55c955e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256578, "uuid": "e4545d85-e0ac-4e00-a0c8-ac99862c9059", "value": "B1C5231639C4AF10D22808B2D1BB95644BF3A5C367B3D6427D84A3CA0E107D9CD9BBCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256578, "uuid": "744f1cef-ab26-49e6-8623-b0342b925a20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256578, "uuid": "45d08592-9750-4317-b3f3-f4b6e9fa817a", "value": "49152:DGjqtM1dZBrFUugqFtGGNIyVIgrEbnxzpBvzhCGFFO0c0NGKPkcDLpYGw5TSQND:n+1dXrFUugy5NIyCyaxzpFhCmFO0tNGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624256578, "uuid": "d9d3d200-a13e-498d-914c-070fb93dfbc0", "value": 2591232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624256578, "uuid": "0ec794fd-fae3-4cf8-b5c5-b7cc6c199682", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256578, "uuid": "d5fb9a7b-72f6-4415-9a17-c09464ccb25f", "value": "46027b0c1c0ea082d511e287032a8547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8441d640-d29a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624284665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284665, "uuid": "570e96d8-7eae-4928-a30a-6780ab4a7a99", "comment": "Malware payload (Formbook)", "value": "76eaa01acb9f26a9ff73d4c42ea74b65", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284665, "uuid": "2483c096-667f-487d-8279-c84facc501cf", "comment": "Malware payload (Formbook)", "value": "99feae8ef0422c9b36b0031102e05d65b6d5028987b5fd421a8ce4e206ac2863", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284665, "uuid": "89005ca7-1ce6-4884-b353-b96dfe01d42a", "comment": "Malware payload (Formbook)", "value": "a2ccb3205a034368a7f79262a8305e45d8975f9c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284665, "uuid": "a1a4db0e-8413-4924-a4e4-36ca6f8d9779", "comment": "Malware payload (Formbook)", "value": "2c04ee82af45e52a6926337f8cdd7739a6c906a4855a93933458bd8a7e3f754e770eb34f8f14210d535d994a9e6531d9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284665, "uuid": "0338d64e-f04e-4ea8-af09-1b187aaac2b0", "value": "784512F59DA90AA2F14E16365CADF470165FBE3C3029B223170BF939913221853BDE36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284665, "uuid": "f68cfa22-c83c-4184-ad74-e0d48948700e", "value": "24576:MbKQeOrBAL/FRoO4NxbjIvanNscHS/wBZ7D7qbdOqHhiE354Zvp8Ejwt:cMOoNRJKmwwwD7D7+5hii4jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284665, "uuid": "bb5d94a9-1655-459b-8894-534b222efd41", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284665, "uuid": "2c269695-2324-4077-b8cd-3b38499bc442", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284665, "uuid": "2643059a-4c17-4979-b66f-bfdf490f37c1", "value": "AYN0711743 - 0PFFCE1MA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d263ae7f-d2eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319585, "uuid": "d70a2f70-b439-4e14-b4e3-a7497da58d46", "comment": "Malware payload (Mirai)", "value": "080b90e68ce61acfabb6cdc5fdd1fd1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319585, "uuid": "57e58ec7-d9ef-47a7-9c48-b9d6a67aa9f8", "comment": "Malware payload (Mirai)", "value": "9ab44c427f52a8ce59c42c37dd9cee6a6f34023dc731772949ad2fbfff790318", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319585, "uuid": "32444c3b-412d-421f-86a4-594b1b9ef207", "comment": "Malware payload (Mirai)", "value": "48db1001455fd03f3ca493a7707d0d446c08d09c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319585, "uuid": "a3fafdf7-1c81-4fce-9120-f5f686ece05e", "comment": "Malware payload (Mirai)", "value": "3ee59728a67c7759cda7f2838b6ffa059586c683c8ce9ec292bfd3bb54a7ee1b863e641bb80c8247d81d13b9b441f0e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319585, "uuid": "0f21f916-29f2-4288-9acd-013bca03f19b", "value": "91F2F175BF59EC31DDB0243F8898FC8159C11B34EB66701F0412A96DAA825C72AF28D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319585, "uuid": "f52a0d99-85c0-44c4-8db1-884619f6ca90", "value": "768:+L1Xbnn+KP8jIdgVEAVjBdF3Mps470tGknXwQ09q3UELQh:+5TizhF3MpNGXwaLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319585, "uuid": "46386a47-e084-42ce-898b-2d39db7016c7", "value": 36272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319585, "uuid": "d0dc73ba-4c75-4b09-99ac-1e9db4fdbfcd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319585, "uuid": "be316b3b-c3b7-4d5c-91ed-4bc90462a3fd", "value": "080b90e68ce61acfabb6cdc5fdd1fd1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71850bcf-d2bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624299236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299236, "uuid": "68870315-d3d2-44f3-b987-fabdc896b8f8", "comment": "Malware payload (Mirai)", "value": "e346c7074747e189e1dc12550dc6d458", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299236, "uuid": "27d5ee18-1ffc-4ff2-b4f7-471b309c01f7", "comment": "Malware payload (Mirai)", "value": "9b7a37b586e409f2bba8d4e8c630b976488dc8a6d607126115d227e24bfe2dfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299236, "uuid": "5c8a4f6f-835f-4a7f-8e91-fa04bacccac1", "comment": "Malware payload (Mirai)", "value": "27c2702337968e7ea65a4b2d9dca92029363b1dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299236, "uuid": "e9ffb6d8-c935-410f-9cb1-311010e986b0", "comment": "Malware payload (Mirai)", "value": "82e34aac6820ee34597ed6f17e39d1bf8b5308415aeeeccad4bc2d0c6fc0b43288dcaf601172bad102093312fa332e4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299236, "uuid": "5a1d2046-6c6b-4419-889f-87957552a0db", "value": "CAC2E1DFB49A39C5CD1C5CFC218D56D115A9A2C7234B9F0837202DCCB6B615EB8AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299236, "uuid": "30f001e8-e2af-4612-be66-5793ff63c972", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBZWG:oCrJgHiOJrfwmQrctl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624299236, "uuid": "987c22ed-1949-4043-b056-6cce34447bb9", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624299236, "uuid": "cf011cb2-1768-4ede-8fb5-dc8aa1002db1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299236, "uuid": "e1e8f15d-2c4b-40e4-b6f9-45a966f19bd7", "value": "e346c7074747e189e1dc12550dc6d458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e6bee7-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303637, "uuid": "ff8da129-8753-4690-93b1-a0d2f685b105", "comment": "Malware payload", "value": "b41586d76520b3a7b5ee1fe9250489e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303637, "uuid": "3fea664e-7061-40df-ab48-2255f0d96938", "comment": "Malware payload", "value": "9ba401c5d14030d60bbe2ae5cb7d872262b9018271aeb3d95f456af2754b1327", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303637, "uuid": "c44dd97d-3d4d-4965-b3a7-073e0ee97959", "comment": "Malware payload", "value": "eabe3fc78373a8b26a7bdc93e9f90c1e5f5d9e90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303637, "uuid": "e78d1ffb-f0d5-45c2-ab4a-600896804f31", "comment": "Malware payload", "value": "331a5f5f2b23916cb5d2c5356e345a92ce16f706a7d38dc2be5d15d50d0c7ffcb1f03f96b51350c47c811ff8324b4c69", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303637, "uuid": "b826ab86-9506-47d4-9d59-cc4b125871ab", "value": "D1647C017A889030D1F352760F24EB81476DB9665B718ADF3BEC2D8E1F7A4D29336762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303637, "uuid": "0b4e5fe5-3f20-4cd8-84ee-214d8dc3129e", "value": "8199c7f6de79daeb94a04a3f31dfd4d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303637, "uuid": "894885b6-2837-485f-b573-2beb4bd7ecb0", "value": "6144:nwfyz7+Vg3teuh/2Yg9AXCeJBhqNgam/HGuF1Fanm:nw+7Agdeud2Yg9AXvBhq2am/N1FUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303637, "uuid": "8267e2c8-ee63-401a-944e-28686d4d563b", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303637, "uuid": "dfcc69aa-a828-4a71-a438-3a539a181d3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303637, "uuid": "5d84cda7-eecc-4cb6-be8c-326e38378fb0", "value": "vbaCaptionMem.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f65609-d2ba-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624298270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298270, "uuid": "7e14f991-3c44-4a16-b2e5-8c385ab355f9", "comment": "Malware payload (RemcosRAT)", "value": "b02aed93596dc4b3ef2361f0f875cff9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298270, "uuid": "163a3fa0-1cdf-431e-8cb4-8ef8951b2d7e", "comment": "Malware payload (RemcosRAT)", "value": "9d109cc4f855ab857f7bc081a7bd0e2be2a46d59282970f1a189a019b4467173", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298270, "uuid": "7f74ca9e-66ae-4c94-bfc7-d1d8dabddf7e", "comment": "Malware payload (RemcosRAT)", "value": "695aef87231946f743cf74fea17433b8dee01f09", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298270, "uuid": "d126f622-f28f-4a94-a7e9-8ace60dc4d7a", "comment": "Malware payload (RemcosRAT)", "value": "458be4adfd7d30aee5aa43eca8bbf8040004c40707ace9a349bbd36f4dcd98d8f95414aee4ce5924dabf9ff5ddd3c16e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298270, "uuid": "b6cbc7b2-f8e7-4e9d-b0d4-f468caeddab9", "value": "70F47CF5A24494B2E8233D78CD4FFAC8A129BCE03C249CC956D4BE55AEB9BD1351E053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298270, "uuid": "31b1fd1d-f357-4e1a-a6b3-1c883d6f1baa", "value": "232fd50d8db3214e3b8d8505003a9796", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298270, "uuid": "318020cb-8908-4272-be02-ec9cd26720bb", "value": "12288:vT74yhBjpQxPKmlHb9F82wmfOwc+Tb2QzIgM61OCQxvdHEh:v/AxPK8ZexEOwc+TtzIghOCQxvdHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298270, "uuid": "9a6b8963-48b1-4c4b-b7db-6e810b9e4789", "value": 744088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298270, "uuid": "ad299761-fd6a-481f-8df6-ca4d7d17db7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298270, "uuid": "e733afa3-3915-4d86-97e1-d6e7ca9eda3a", "value": "DHL_1207110474 de recep\u00e7\u00e3o,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7fc2e2-d29c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624285539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285539, "uuid": "2a207691-a706-42c7-ad94-7257209580b5", "comment": "Malware payload", "value": "03332344ce3777675f32f0a09d5aee40", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285539, "uuid": "a7de7605-c737-4ccf-a4b6-fa06244135b9", "comment": "Malware payload", "value": "9d1f6138e2fc71b516dbf163e098da4cfbdec0f6b5495c5e04f5993e8270c754", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285539, "uuid": "13f76eea-3d66-4da3-956d-7fa343907cd2", "comment": "Malware payload", "value": "c0dbf590f295b2fe60f575553fc2c8d6af45df6e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285539, "uuid": "7549a7ec-8b87-4320-9b8f-e2c3d20979d0", "comment": "Malware payload", "value": "f2ad169282db41f6919a1cf2c9de4dc2524afcb394d4dc34c65f29deb33f44508e2c8106748118b3738224ed95188957", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285539, "uuid": "41ed0173-7be6-4704-ae3d-797b26019722", "value": "D551A819FC47D15CABB9235BEC97C926FF1B811B5DA2104C71DCC2551F3080996ACB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285539, "uuid": "ba3bacae-355c-4b0c-8cfa-db25d5bdec74", "value": "48:Ax88iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozl4i:IGhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285539, "uuid": "652eb691-2b59-46a4-aa86-be0659e7a221", "value": 3143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285539, "uuid": "e8e9f9e8-f5da-4b1c-b4c4-6022a30a1593", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285539, "uuid": "b9d9f8b3-5350-49ec-90f2-1e8319a181a1", "value": "J0Cu1VX0.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae88fe7-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1624298634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298634, "uuid": "04f76385-b7fe-486f-9e33-7c1d2d21bcef", "comment": "Malware payload (TeamBot)", "value": "1f81d5b16feb795f3c35e7cf508aeae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298634, "uuid": "447e148d-8134-4d28-95a2-f2fbef5d089c", "comment": "Malware payload (TeamBot)", "value": "9f3a122061d4ce7677d0728299243037fb982ccfa7751104f603d134408c4672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298634, "uuid": "5e9bd1f7-24c7-4de7-a7c4-7d15e4378d46", "comment": "Malware payload (TeamBot)", "value": "f774e4dd9670d66e095b0159ee3018f8aa341f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298634, "uuid": "38d715b4-1d30-4623-b353-b1e1328052f3", "comment": "Malware payload (TeamBot)", "value": "91d3a75741c1bc114d7fc798b938cf955bc80b5cec17f53f663aac13029dcfb2c36d453c1f02ead426a36d5e7f0478c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298634, "uuid": "e02c0113-e190-4903-ae53-c15fdfb94386", "value": "8C150100A590C035F3F765F85A7693AD992E3E626F6651CF02E922EE1B347E0AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298634, "uuid": "4d448413-98fe-45a0-9b7d-f2421c7f7d5b", "value": "ac10b7532049d5241ef7eabe1eb9990a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298634, "uuid": "65553368-e87b-4896-a398-2ab560b96d80", "value": "12288:ZzYUHKTDHmpUDVULc+L78i+by63q5wimGWA/hSi5mh5mYgsIQKAoSHuf2XbxAwGZ:ZvHKTD50L78hm6CwpG3S4DBHxtuei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298634, "uuid": "2d113fcc-72db-40ae-822e-848cddf82cdf", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298634, "uuid": "c21db1c3-eb24-4a5f-88d6-8c8fd5cb78e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298634, "uuid": "e63561bd-90a9-4aa9-9d7e-bf5802e03e62", "value": "1f81d5b16feb795f3c35e7cf508aeae1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e17721a-d25a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624257059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257059, "uuid": "af7238f7-712f-40d5-83d5-e9fc031806eb", "comment": "Malware payload", "value": "407c8b693e115798a1aabbec6b300624", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257059, "uuid": "28de33f1-3809-4d70-ac76-8a1cad86fa13", "comment": "Malware payload", "value": "a1fcc2de19c499902cf1f8b243af4e25bb097e519ffaea2266129d2e635b1368", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257059, "uuid": "2f8d2be5-b734-4f33-a499-b784047a8f15", "comment": "Malware payload", "value": "850d61a923e4231f22f6093f9f9a594b9f34ee77", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257059, "uuid": "c4c93abd-82df-4168-a71c-0c6d0ced7732", "comment": "Malware payload", "value": "471f3572c6c8d694df1941a77a2acc3823ed295d4cd1108031a292b78ef4b1323366cd55ea7e8bc9284781f75d1b06bb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257059, "uuid": "d4de0612-6a07-4922-8209-82a155d46eac", "value": "A08568F0AD01D4C1F5BE5B6AF2FD3A48A1343217EBC94A4A00E5E5951EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257059, "uuid": "6ee79f6f-a818-4aaa-bf1c-ce13ef7fd735", "value": "12288:Dy0/EFUHnrtIJBa/BtfOLaZQWrS+H8UErBQLeugDd:Dy0/ECGJSfOLTmwrOgDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257059, "uuid": "8ae32c94-3348-420a-aea2-a0c73708ae4d", "value": 1707224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257059, "uuid": "dbd50242-682a-4eb9-8cb0-3356ad7406c9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257059, "uuid": "08d9cf5a-b962-4e0e-9961-6cdbf4580ff5", "value": "INVOICE-CVE-0814.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb19dd9-d23b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624244012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244012, "uuid": "7ffdfdb3-8506-42e8-a24e-85596f18a88c", "comment": "Malware payload (AgentTesla)", "value": "fc0dd659935df6b88eb705ed5ff41f72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244012, "uuid": "befaea2f-c67d-4166-8749-cd2bdf66c914", "comment": "Malware payload (AgentTesla)", "value": "a272ee0b70107d2e318321ecca3147425f663beb85f0f8dc80fbb21ba27c952a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244012, "uuid": "b58696c9-1080-4ab0-8e1e-7c6bbb13efc5", "comment": "Malware payload (AgentTesla)", "value": "0a7be47d975221f1755330a19a45268aca69e75c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244012, "uuid": "49b8b377-32cd-4ac0-a242-6756aa707202", "comment": "Malware payload (AgentTesla)", "value": "aa90cfab2fc5ea22a5722a7ae29e225e92e8b24fa08991884fbea4029d85339c37b54b11ab04d5755c41ec8d8c4daf6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244012, "uuid": "e004e5c9-0be8-40a5-9cb4-0dad8fbd8994", "value": "8405C02039AE6109F57BAF795EE476F2967FBE237B07D81C10E4334A97239428B40539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244012, "uuid": "cb74dc89-0eac-4f44-8a23-e7efa3e3e56d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244012, "uuid": "c5784bda-d149-4c88-b8ea-1e19d17754c7", "value": "12288:eFF1s0Tz8SB9iI4B//vMSWFaVjPsfeACKqBw81W4BJmnWwmHhU0GI5EYXWFHfs:dSB9iI4ZvgmjPmo7jwkGI5LoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624244012, "uuid": "a1044656-4a0e-41be-9d94-418514a4f5b0", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624244012, "uuid": "cb7122a6-96dd-4951-a3f9-e37974ae0537", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244012, "uuid": "3913acce-0fb7-4179-825f-f4218533f242", "value": "SecuriteInfo.com.Trojan.PackedNET.854.8381.128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034769b9-d250-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624252665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252665, "uuid": "aa009262-8e13-48e1-b8cb-ced31039ee99", "comment": "Malware payload (AgentTesla)", "value": "b81e0112d358b4570c78b058bf9d8aad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252665, "uuid": "22554bee-1414-467c-a789-06bf7bc9cacd", "comment": "Malware payload (AgentTesla)", "value": "a2ab4d45b0c8718c31b8e315263577916f7e7dfc2b62c083ce4d4ca9a94f8451", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252665, "uuid": "611f5ef3-b27b-44ab-922a-94b342a14b76", "comment": "Malware payload (AgentTesla)", "value": "bb0826309b53e419a118b0c121feba1818ea0d90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252665, "uuid": "7262542f-9614-4158-8836-530a2d0cf52b", "comment": "Malware payload (AgentTesla)", "value": "360d5b9a5cf6cf55c19ef55d02b51035c8494e457af54bbb36c260a3a17ae1402c77e3da1db345c45f92efc015565212", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252665, "uuid": "09e652f0-c46b-48c1-b265-e0d9b8ec99f0", "value": "BCF4B03039EE520DF57B9E781AE436E2966FBE677707DD5C24D4234A8B238428F40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252665, "uuid": "9e449679-1c90-4cde-9ac7-0c2e375d318e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252665, "uuid": "f7963ca0-d344-4744-9db5-75c57c119705", "value": "12288:uwRclOWFHmsk1YAa/Uo6uiLCgLqt6jywFB3jXFAO3fMhwQFHhU:udtHZ9/a3LCJt6jX3xN3fMhwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624252665, "uuid": "bc139144-0da2-446f-a1d3-bde4b455d767", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624252665, "uuid": "ed262999-88fe-404a-b06a-978286f71ad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252665, "uuid": "59aa2394-1f7a-4749-9aa0-8bc060298bdf", "value": "PO - 088_6_21_2021 - 0000000000001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd74e53-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624258451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258451, "uuid": "b71fbcd5-5d55-4b77-870e-a8866a1d7734", "comment": "Malware payload", "value": "56678873f3e8601ba104e2ad6d152195", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258451, "uuid": "c5c0174a-42e0-4738-b4cc-6e6c9a865da1", "comment": "Malware payload", "value": "a33eb56f8df0f71abfd2d81c4d8d53a6887b69f138a41a131695c870b05f0687", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258451, "uuid": "57f25d20-b739-4620-af7c-504248fb6e9b", "comment": "Malware payload", "value": "c18a2598b64fef14f14bff38b6d78206987b47ed", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258451, "uuid": "4a999958-a2b2-447d-a4f4-bfdc63f7eadd", "comment": "Malware payload", "value": "3ecf27102b20f0e1ea03334467f09e9a6b1d93f865d2c9b9968226a69a3093684910edc62cfcf74b6c0b248e8395d952", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258451, "uuid": "f39cb7e8-93e5-4f42-895f-7c7799663399", "value": "0701470C6E70F1C49584E10EE26818A2C89008AA949AAA0A5197EC8473E8AEC5D1D7EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258451, "uuid": "806ea0c9-df33-49b0-b18c-5f8d60fe1ce2", "value": "12:XBFErII/Ru5YKur3URwfkvzgFWczdjZ+Knbm18XTNbIy2q9/IC:XB2rnfKYkROqzkXzddm18j/xIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258451, "uuid": "438f03f4-3b85-4403-a529-7749c0a606d2", "value": 701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258451, "uuid": "438ea062-25d7-4fd1-93d5-4c94d07b53fa", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258451, "uuid": "b306c63e-50cf-435c-9d8a-4a5397e2c02b", "value": "PO-CVE-JUNE-0814.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4a3426-d28f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624279766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279766, "uuid": "bc25b19b-fbc6-4807-847c-492336ae924e", "comment": "Malware payload (Loki)", "value": "d62352c033c995573d7c9ec1cf2ea1ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279766, "uuid": "bc324424-5c5c-45ad-bc71-281f6a7743fc", "comment": "Malware payload (Loki)", "value": "a376668a48de6be4c4f85e7abc40fb3806580c2733912c6e400db843e41aa056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279766, "uuid": "d0f73be8-5e32-40c7-8b29-3b34492b744c", "comment": "Malware payload (Loki)", "value": "a7b09453ee239a69538bbd1079429968634ab3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279766, "uuid": "fda1843c-e3bd-4c25-a884-e23ce75f468b", "comment": "Malware payload (Loki)", "value": "27edf7303e6fdac3a95bf9de1e83bdea6ae364013c2371f4414141c326a1e4cae960880a379d31ae07c53c0c493e1e2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279766, "uuid": "b3467c87-ba8d-4760-af1a-9c0be6aa3936", "value": "9E9447266112F42EE6B7C13D2453F10ABA133F1618F1496A97873BBD0572144AAFBF36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279766, "uuid": "ed3bbe92-a110-43a1-9ba1-f95e5cad4457", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279766, "uuid": "48c9372e-6858-4592-b180-f05a677f37d0", "value": "6144:FV3NOhdEptAhFNlkBnJ2Z4/pXqODHORLnHPrzOX1xCkZgqgXN:FSh4qTkJMDEHOR7vo1ZNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624279766, "uuid": "b593a1a8-b5ed-4fb4-b6ab-37868cd1d522", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624279766, "uuid": "5abb37b0-b905-40dc-903a-5679379713ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279766, "uuid": "099567e2-a075-4622-bae4-c4ef774b45e2", "value": "HSBCpayment_advice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88d65d5-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624259063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259063, "uuid": "cb82a145-0218-486c-a1c1-e6bddfe02f9b", "comment": "Malware payload (RedLineStealer)", "value": "350d120fa10b2400fd108dbb87577d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259063, "uuid": "3dd2b98c-0240-44d3-a7eb-5a2246c1f9f6", "comment": "Malware payload (RedLineStealer)", "value": "a43aeebdf142d982d97157178d0b190e386b39d532c8782a7767f84f2a88e97b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259063, "uuid": "3e3ee998-8711-4d1a-a7d6-2f2a54f19c45", "comment": "Malware payload (RedLineStealer)", "value": "3b3fe66f40de40d13f8cb00f95e1b84ec077e70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259063, "uuid": "78e71ae5-06c6-448f-b5d8-efe65c32369b", "comment": "Malware payload (RedLineStealer)", "value": "b5268c91963e18d1528083cbe6d3a9127d22a64faf25b5b0aad2eb3df8aafb9a44b3142e9dff7db911dd4c1d75765266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259063, "uuid": "26894f99-f512-406f-a268-f59008e0e6c4", "value": "67B5334B72DE854BF4634134D85EC0B46865EFFACA01C66B39857A0B74E231722EEBC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259063, "uuid": "e1edcba1-e292-43b7-b81a-7489471bc900", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259063, "uuid": "a3b224b1-387a-4008-a51a-d1aefd587976", "value": "49152:QiI0MRZ2deU2IGq/jipDDyyGQIwMq6M9/4pSCegrxkmD9khBS4xJRqX/:Ql0Mz2dew/upnylFwMq6M9/QSCesxkmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259063, "uuid": "d2477c27-a935-4ef6-afda-29ade89ed17b", "value": 2308468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259063, "uuid": "29d19d4a-9c32-45f0-a716-21bda3f48d7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259063, "uuid": "8a374721-e820-4866-ab68-15586e72bafd", "value": "350d120fa10b2400fd108dbb87577d3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38315c62-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284966, "uuid": "df1e9782-3231-4e14-904c-38bd85ed2c0d", "comment": "Malware payload (Gafgyt)", "value": "e7b38a5a1cb964a01348ca34d015b114", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284966, "uuid": "d4f7fb1c-94bd-41ff-b185-1db24d3f610e", "comment": "Malware payload (Gafgyt)", "value": "a45f40f2001545acbd41e4c08380a583687a5bebc9d00a57dd6e384159c5c7a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284966, "uuid": "db29eeff-8131-45d9-aa80-d4a5a4d60a2d", "comment": "Malware payload (Gafgyt)", "value": "21d8a556d79b02f62bc207c2e4435a77d6d7d807", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284966, "uuid": "426d4c71-1e18-4db1-a8eb-523d26964536", "comment": "Malware payload (Gafgyt)", "value": "a30cf3e6af1bf27e22e9cb0dc869991f30d460da8e0d57df7938cdd343233a77ff3461536b81c0fb3c17821e8c84431c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284966, "uuid": "7315ab2b-aafb-4a47-82cf-8305946c272f", "value": "EDA34C46E603C6F3C4830AF5125FDA5A0931BB7A4A3B9EAAF31D7CF49B528C53111B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284966, "uuid": "5f329888-8682-4c9f-be2e-41da9907e132", "value": "3072:q+xTbuLCOaAoriAGIe5hxfh3WQ40Qz56YQ24k:q+hbPGIe5hxfh3WQ40Qz56YQ24k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284966, "uuid": "8c284382-9316-4d7f-941f-547cf592176e", "value": 99898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284966, "uuid": "fdfa4f76-68ea-453c-8ebd-9bd01f50ec79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284966, "uuid": "9f0de6f9-dcc5-41ab-8f70-fdcfd1cae4e2", "value": "e7b38a5a1cb964a01348ca34d015b114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2dcdf4-d298-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624283925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283925, "uuid": "43eb3110-cf44-4d79-9f72-d07712470162", "comment": "Malware payload (Gafgyt)", "value": "1fdb0cdcd047811174f4af8c53a4c308", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283925, "uuid": "ca5f243b-8ba0-4076-b2ba-1520a95aabb2", "comment": "Malware payload (Gafgyt)", "value": "a4932756d022e9b817245108f4597a2c35613f4af3fc3667e1bda7a275a6cf43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283925, "uuid": "f9da6da7-d771-4e3a-884e-09718ae1e1ed", "comment": "Malware payload (Gafgyt)", "value": "e4c5f38a0c5275ca92c7cb9b81dd295ac8f8c439", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283925, "uuid": "ddeefc2f-71a7-4f1c-9cd1-6dc2537abf03", "comment": "Malware payload (Gafgyt)", "value": "4dbcf6686d308e91daa68d2b5eb3d45992aefc93959103026b2d105661bff75cb573c31725e16c5ed139f25b6e811e71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283925, "uuid": "06c1111f-f7d8-456f-930a-b985f1e542cd", "value": "84C3F605F8414B27C7D227BAF78E438D7B356A9867C73311AA385EF02BC57982E39560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283925, "uuid": "2bb420ca-b114-4c5a-af42-42e75c045e39", "value": "3072:3KDQkylnQDnoJSOc2L/TatEBuSA5ha44cbp4M+L48EkDtE+x79SDQHD+YZAlRm:ptatoxA5haQbpyLx79SDQHD+YZAlRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624283925, "uuid": "ca0ae267-a4d0-4b2c-9608-62c09f63a002", "value": 121119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624283925, "uuid": "a676afab-db95-48ed-8194-57029e4042cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283925, "uuid": "ee4147c6-9aa5-400a-b2b6-9f5ee867668d", "value": "1fdb0cdcd047811174f4af8c53a4c308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dba3e99-d24d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624251475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251475, "uuid": "adf07c1a-65d6-4513-bdea-1777798d5dcf", "comment": "Malware payload (AgentTesla)", "value": "14ff88de9a90eb9a52be920456093338", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251475, "uuid": "fc87e555-1c26-4320-8b95-5b83fa0d9222", "comment": "Malware payload (AgentTesla)", "value": "a4b39d55ec99198ecb996b335bbc980e86578a66a27263875f7b4cb072bfaeb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251475, "uuid": "f9b9e13d-5c03-473b-b871-58b24a248988", "comment": "Malware payload (AgentTesla)", "value": "e2b7da28ef1dfcc2d1866556e22e6350ca84e54d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251475, "uuid": "d64336ce-eb7a-4d6d-b43f-e91042e4b454", "comment": "Malware payload (AgentTesla)", "value": "55231b9f32fedff4019ced3d97f67026ebd8853628bb0b4af419b2c6d29bec8463fd5bad6d5688d1f787174a93714486", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251475, "uuid": "a4d05110-7e5d-4200-b2c3-4f3ee7046147", "value": "84156B9C3551B89EC5A3DE72CDA42C54AA217C76131BC20B91673A9C9E3DB86DF002F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251475, "uuid": "c7cbf5cd-557b-4610-a948-5668de7e85a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251475, "uuid": "3f7019c1-541d-428b-a8b9-3cf55835cb52", "value": "12288:u3Ejpbimrp1E/X1q+WW7bfqTxQT7hzdfscN3fA4z7Q4EPGXnkjyZjVOZyGvJemmK:tBiWE90Wff8QfdmcJf+TVKAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624251475, "uuid": "4daaf548-b64c-4c7b-b05d-bee3690d1484", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624251475, "uuid": "a52aaf37-4926-4582-bc7c-b65e75359cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251475, "uuid": "4c4eaa3e-2772-4d27-94ed-9f40507c4320", "value": "quote #2063 almaco.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461380f8-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284990, "uuid": "149498ea-3f74-4d4b-97d7-b7b3f5110972", "comment": "Malware payload (Gafgyt)", "value": "815ae824f73397230f690b1303b20783", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284990, "uuid": "4c1f7f98-8755-45f7-b627-e47b2b4b0fff", "comment": "Malware payload (Gafgyt)", "value": "a58ac19864abf56fe6ff7169dab9d0cc3e4570cb67bd01388838be1631ca0881", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284990, "uuid": "456cb049-c133-46d8-a153-e3bcf8ec39b2", "comment": "Malware payload (Gafgyt)", "value": "ea2cb6dd912b02ad7806e2c14e84d0651ec8f0df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284990, "uuid": "53dd6530-473e-4bba-ab76-97259313caad", "comment": "Malware payload (Gafgyt)", "value": "d72f867db1b3f42858958829ff83de6284280354aaa937c9a9f54b530e957c65e992d77e39bab2dc20dee03df91f723f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284990, "uuid": "982f0662-0493-400f-b649-4ef1a4a5f5e6", "value": "6DC3852A7E22EFFFE668863107F35F708795219236A19385E26CD6181F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284990, "uuid": "818ddd8e-de8f-4e6e-94f7-b3a00b31c824", "value": "1536:BYrJWOuw7lqYyq+rFzt92ceG22rKyHnC6F6Qe2jyQ8fQNt/ZpkRx9Z/5RJSSdom:rUCzRHnC6F6q98mPpkRx9Z/5RkSdom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284990, "uuid": "7b815299-d670-462b-bcb4-bc5d2281068d", "value": 123171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284990, "uuid": "659e99ac-a17e-4e60-a189-df296a8d2bd1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284990, "uuid": "b8ef6949-c6d7-4165-b826-d1815fba86b2", "value": "815ae824f73397230f690b1303b20783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d92bac-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624303584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303584, "uuid": "804dfca7-f46c-4b03-93ad-3f1ad7b11fe2", "comment": "Malware payload (Gozi)", "value": "98d030eeefc3536d68ccb9ae3a2d1502", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303584, "uuid": "e5b3aef3-084a-4e09-a789-fae33bb5ec59", "comment": "Malware payload (Gozi)", "value": "a58f423a00ca933ae2898803bd1b3a07a2cd76ef1aa0d5de69905d80a096874c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303584, "uuid": "c1572ec3-ad0d-4996-a714-132cc2467d0c", "comment": "Malware payload (Gozi)", "value": "9f7d95691e0116f7c0d0f222de2149b073ef6cb6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303584, "uuid": "0f35821e-0c9f-4281-bdb6-3c8efb85ef9e", "comment": "Malware payload (Gozi)", "value": "878d260ae55d714eceba24688224dbe38cda9eb9157d0639e5b107f09af1ff0163f9c335f6d6ed0c5a344af2e82ccaed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303584, "uuid": "6d5d951d-0333-4105-b125-cab2143a4c6a", "value": "E0647C0179889030D6B262764F24EB810BBDB9651B71CECF37DC1A8E1F794E29376762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303584, "uuid": "af1f8af4-6254-4970-970b-7e4c7bb1ae54", "value": "cafd4f67066e4431e00f052908a506e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303584, "uuid": "771402aa-f077-4d11-ba3a-f01a79bd86ae", "value": "6144:oUtzB0RzsWEV3SwawlR81T/F19W6fepyq85t:oUZKRzsthSwrRq/5W6fepyb5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303584, "uuid": "19c249cf-f22d-49ca-bdb9-50633725618e", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303584, "uuid": "46179cbe-f5ae-432e-b462-2e888af7db56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303584, "uuid": "384cad4d-8cf7-4c4b-94a0-edb6b51124db", "value": "boxMain.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea6bae-d28d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624278914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278914, "uuid": "6fd91b54-63ce-4b2a-9fd9-c0c454bfacee", "comment": "Malware payload (Mirai)", "value": "0d6961d0114ca77ee94b5c7ee07eeff5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278914, "uuid": "b9e1c391-66ca-4688-85cc-977b1e2f5540", "comment": "Malware payload (Mirai)", "value": "a5fa0132b7af1e9273e3d43a41749cf961f1131e7aaecbbea36e60903026ca9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278914, "uuid": "9ce06c81-fa34-4313-9a82-a0aaee19592d", "comment": "Malware payload (Mirai)", "value": "8d05dd1a064ec71281733b3a236174fe77b3f542", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278914, "uuid": "e96ecd1a-81fd-4903-a43f-f9cf87531047", "comment": "Malware payload (Mirai)", "value": "96f2fc5c257956f49f840518c5ea85c9ab7634392794028f140f810fffd4b4e8ea0cccb6eb885a7adafe6c85a31e82ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278914, "uuid": "35fa7c26-e46c-422f-9778-d03d96f7b332", "value": "9403064AB9C19B05C5D112BAFA1E124E7313576CE3EFB3225E246B24678B57B0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278914, "uuid": "47bdadfb-f647-4094-a5aa-c2d994dc7080", "value": "768:UAnaKAAppS3NKuPkWx79U6miXt4+w1oo24YVTm6mhySe/GB:UAnaupA0EV7Dmid4r1oo4ewS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278914, "uuid": "93a72530-e347-4d36-a1de-15c6eb1908d3", "value": 38252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278914, "uuid": "4a6e79ff-600a-4eaa-b701-89e54208e94e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278914, "uuid": "1b76bd16-8ab8-4ad4-8c14-115854622961", "value": "0d6961d0114ca77ee94b5c7ee07eeff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7070f99c-d259-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1624256714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256714, "uuid": "8e3546a9-4c75-4206-b416-63f898d23871", "comment": "Malware payload (Dridex)", "value": "a5d2da83ba4ac307fa3207772e45767a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256714, "uuid": "3841dbf0-6ac7-4ec1-92e2-046785afa536", "comment": "Malware payload (Dridex)", "value": "a5fc669f505c4e801fbe0859af1db44e55462bc59d78d5d6c90b7d3a78701728", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256714, "uuid": "d6fda6c3-dd4a-46fa-9597-9c91a0cc33a8", "comment": "Malware payload (Dridex)", "value": "e8f10d008b6eb42d451df77c6613f2876f6138e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624256714, "uuid": "fee0b24a-a6ba-47ef-ac2d-dad09c140807", "comment": "Malware payload (Dridex)", "value": "39112a03d7f1994c7fbe4834eda180dbde348b14750635abe6c4dd7df24f53cb6ac0aad1cf3ff850b133d76b2d36aaf8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256714, "uuid": "93159db5-c422-4a32-bfa5-2c9143f5920e", "value": "7A650102676BEDAAC8168D31EC13533293969F142BFB6847F6807ADD31E87A155323C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256714, "uuid": "5f91aec7-cc15-4c82-a7e2-0fad0da54feb", "value": "6935ae43ee15f732f7819314961b3de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256714, "uuid": "def77e8a-df62-49e7-a091-4015626dfa0d", "value": "6144:NRP+tvAbB0TcAcig3SuEE/UPTYkkK795PuBSciRzWpIIjxmV:NgdAbPfh3SW/Uc5K73PuBMRYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624256714, "uuid": "5a9eb708-8a6d-4aaf-9463-bf316cfda516", "value": 1513984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624256714, "uuid": "d034703a-e492-475c-b4d7-88b682e5c0aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624256714, "uuid": "07d8e1f4-be58-4279-9129-a4f2b8f242a2", "value": "a5d2da83ba4ac307fa3207772e45767a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a65525-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624287304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287304, "uuid": "ecc09804-d1b7-4d40-8a41-0d6bd26e91ca", "comment": "Malware payload", "value": "67897b2c1425411173ea7054d21a93e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287304, "uuid": "003171d7-b1c0-48e0-92fb-8e35804e4973", "comment": "Malware payload", "value": "a6896ef390d994a7ff4c9c07775ad15dbd207c72079a473389990d462ad81387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287304, "uuid": "ce9914fc-5135-4d82-94cb-e2696b09f324", "comment": "Malware payload", "value": "d615b097aeb4af39a4c923e7e78dc8e2eeb5b8e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287304, "uuid": "d9331209-e59b-4ce9-98b1-2a28882b4176", "comment": "Malware payload", "value": "025057148fa239a9aac362aac4c172d7a5a3334969ef0b5804d2a1b1c59121495478c8ff45a5dff54ed749ef738ed88f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287304, "uuid": "5d68b9ab-29e3-43a0-8f50-e0775f3d586f", "value": "1876332078CACCF9C4AD2631C76627AAD5B6A6102D744D13B3760EAE06BF741D13939F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287304, "uuid": "8682d84d-f096-4d77-bebe-f03e75ab4829", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287304, "uuid": "8920eef8-2287-4fd5-ab19-f56b2d510fff", "value": "196608:W1OiD9izM7gDIJoBQ1Cg9xtQqLSOr+HUandAC2ajCT:oOiDgzZQVtQqua+hdACNCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287304, "uuid": "86d8bfa4-b36b-48a9-9ca7-794c3c265d62", "value": 7305959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287304, "uuid": "04901c02-b891-4ee7-8cb5-316f1ca6d7ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287304, "uuid": "3a102411-56aa-4984-b4b0-29e5c2770874", "value": "67897b2c1425411173ea7054d21a93e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb88fcb-d285-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624275476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275476, "uuid": "71fbaa24-6ae3-4a38-bc6a-a8a6d1d7680b", "comment": "Malware payload (Loki)", "value": "8e9f8433e3a2888d3c1caabaad1a02c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275476, "uuid": "b05f59b2-4552-44cb-86e5-b1ce0e0b4e41", "comment": "Malware payload (Loki)", "value": "a6dcb375ec518dc845d50e3508c30168f0f12f9e28f221e14734c52fb7f29942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275476, "uuid": "1bf11e32-3054-4ee2-b70e-3d5c00d64d8b", "comment": "Malware payload (Loki)", "value": "b1f5e5b52f57164a8dac3af7cd52cdfdd208ce9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275476, "uuid": "9809b241-983c-43aa-b970-3bce3aaf8c0f", "comment": "Malware payload (Loki)", "value": "615bf4c0874628696dd094913c23108085a8d1de078ac6648202ba476da66cec1ac0b8bb9b46d1122690318a413e48a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275476, "uuid": "f850a38f-8ab8-4cb2-9e78-4cdc7edafb7b", "value": "63D4E0B1319A634FC96E41F8266527F11277AD5BFBABDE8C2DE4310DE7A78960300970", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275476, "uuid": "0c8f6af6-d42f-4e20-9afd-7c59cdd6b01a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275476, "uuid": "51216569-d1ea-412f-ac33-aafddf1f3d88", "value": "12288:zrzlgOszmwhDF2OTl7BuzixjB9DHhUvJ/dvbU:hgOszJDFZJtuzFJ/5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624275476, "uuid": "ab9a3e15-e5c7-44b7-a9c4-08906bb88804", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624275476, "uuid": "4cc13b51-e4ae-4537-8a43-b88fff5580f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275476, "uuid": "bdc6a6e5-ca05-4f13-9621-52dea56960f2", "value": "SCAN files.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb01d266-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284434, "uuid": "1479b1ad-8f44-4585-a6be-486e5f45f44d", "comment": "Malware payload (Gafgyt)", "value": "7233f565a4b81df666fc60a559d47076", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284434, "uuid": "22ec5f02-5140-4fd1-abd0-457b9b37f286", "comment": "Malware payload (Gafgyt)", "value": "a7186b11d84d6545806f585b268b74daed6876a3456380f03a5bd96814e0c888", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284434, "uuid": "ab7ea197-9bd6-423a-a775-838945a415b7", "comment": "Malware payload (Gafgyt)", "value": "d4ec8b9107ec3bb508262809d036a7eafd06a43e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284434, "uuid": "18cd744c-9628-4ef7-a640-e4520014c986", "comment": "Malware payload (Gafgyt)", "value": "20c0ada0e1c9cc46dabb17490a118e9ea83bd93156e16dec33b527d13bbfd80ce21927eec3282f814de7f2fa30e0a2ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284434, "uuid": "89bddf8b-57f2-4f78-92bd-52f6127c7ecc", "value": "4BB33A4799659FB3C086997125EB5A300723FA921B4F1B8A352D9AF0074F8CFB41EF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284434, "uuid": "33495d03-b7e4-4f94-b81e-18bc3da060bd", "value": "3072:lTt2Fhdum4NaXU7fLRZf5h2LBGhMPB09vFeQfPm:lsf4NL5Zf5h2LiMPB09vFeQfPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284434, "uuid": "f1d04d33-12d1-4794-992c-c7cec067b97c", "value": 108348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284434, "uuid": "5ae888cf-c32a-4951-a852-db3594591533", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284434, "uuid": "996c96d3-273c-449f-b567-465603332bfe", "value": "7233f565a4b81df666fc60a559d47076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff002e6-d256-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624255398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255398, "uuid": "233ed41b-b6e9-47a7-86a8-5192422a91fb", "comment": "Malware payload (Loki)", "value": "39e696497da160c9e4bdf1450e587b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255398, "uuid": "6dcaa59d-f200-4146-b294-a755bec0f707", "comment": "Malware payload (Loki)", "value": "a9024badcf414fdb74f1748fffd61a4c19021d151544ce61a5f6ddab5091a68c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255398, "uuid": "0cff0993-2a27-432c-b518-1ac9cb724006", "comment": "Malware payload (Loki)", "value": "ed8a924fb2436e29c42c46905e1c094e9276542d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255398, "uuid": "278ced21-8dee-42d6-9158-8cfce0b7d5d0", "comment": "Malware payload (Loki)", "value": "1f79d4f7c30fbadb9e613c0b5ae44e9175f854052ca18e53cb4c7065ada844fc6b369925a5572b219edf4a08a3d62618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255398, "uuid": "02825f86-c3ce-4326-82cb-c1d97f3c78a5", "value": "6DE4AE7039EE6109F577AF781AE436E29A7F7E637B07D85C24D4234A87239428F40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255398, "uuid": "5c266c99-a0af-40d8-ba93-caf25c5b1b30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255398, "uuid": "f3e89572-ea75-4051-8899-c7220661edf0", "value": "12288:jk4mZWFHmsW0GerXy/nSkaFDejcj4ABdFXztIfdmIngrPmWkoHhU:jAeHdGerXsuDaccABdFmfpgrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255398, "uuid": "82ab1240-beeb-4e17-9415-d0a45b893da5", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255398, "uuid": "7f544724-5c33-4030-be5c-dc65e5560926", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255398, "uuid": "101dfac1-ffa1-45cd-932f-5db8de6462b6", "value": "V8tgawp0z3hIiWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b57b9a-d298-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624283920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283920, "uuid": "7067f890-e8fa-416e-abe9-cf9b8c7b768b", "comment": "Malware payload (Gafgyt)", "value": "c6690939ad79104b437a7a1d6e35554a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283920, "uuid": "6badb561-fb67-4cd2-9e57-5473e2c59cf0", "comment": "Malware payload (Gafgyt)", "value": "aa3213ba28e3c68015f249aece5ededf072dbcb2424c6a7173af7ade23b74e04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283920, "uuid": "dae6f1bb-a499-4508-ab14-1dbac4124dd2", "comment": "Malware payload (Gafgyt)", "value": "4ce0dc4c4821aea4d48f7cb772256e5834507d2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624283920, "uuid": "3103d153-d0ba-4572-a682-a4e485603a06", "comment": "Malware payload (Gafgyt)", "value": "0238d6e68a90a17222ec5b2e8daf72213846dcc71dffd4e7c9fc55d333563fa56226c0fbcf773c4ce11803a40ada8aea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283920, "uuid": "4b47ce3c-ac3a-405c-aa09-c51156549e64", "value": "75E3A51BBB618EB3D81FCE37069A4601108DE55A52E97F6BB2B4C51CE78B84F09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283920, "uuid": "0e832eca-1cb4-45b6-aa64-16e9d5897f13", "value": "3072:TPnpPBBRUs4287EgglyX5hD/YF3x6wqY1o5Bmrm:Tn34287bglQ5hD/YF3x6wqY1o5Bmrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624283920, "uuid": "b50f90c8-bbc1-4314-958f-d0237ba85e58", "value": 150714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624283920, "uuid": "bb431a4b-1b85-45a1-bb25-085521a0a1d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624283920, "uuid": "8f077790-18a6-4aa9-b5c6-5bd118dadfde", "value": "c6690939ad79104b437a7a1d6e35554a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66a6b58-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1624259059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259059, "uuid": "7626c01d-45e9-4897-9e4c-50ae1faf753d", "comment": "Malware payload (DanaBot)", "value": "aa4b82d83212960aaec13ed5794da8e0", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259059, "uuid": "9ac62a85-6b18-4542-a521-a593653aedfc", "comment": "Malware payload (DanaBot)", "value": "aa8a240e5b31ef1c0f7d85f61437b680958dfca31bf7cae5cd1cb8c9383a2f13", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259059, "uuid": "2779a814-9dd7-4d10-a852-4dea26870fe3", "comment": "Malware payload (DanaBot)", "value": "0457ffa7c0683c6e04d32e8cbf71bcf9eff14774", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259059, "uuid": "f6fc0af0-0d23-4251-a696-ba4cd959f3a1", "comment": "Malware payload (DanaBot)", "value": "81d9407fb50a19a8ce97f86831dbbd8ceaff8a09c7397052b0d84d5aed3e437e2bb3aadc259b33c4d0f8adc5b94d71e8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259059, "uuid": "75584f1c-4135-425b-a99a-23a42d64cd0d", "value": "C1351210B6B1C035E0F762F84A79975D6B2D7BB0972040CB52E16AFA97247E4EE3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259059, "uuid": "6cbc85fa-a97e-4c94-bd6c-00c080df82bd", "value": "f9171e3fceb6d8c6fb81cb999790f0d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259059, "uuid": "9ea81c6b-53dc-4d60-bb4f-d3a53b43f384", "value": "24576:FKchFXcwXx+82MIGgOoT/ngM+mBEGweZbDqiJqZnvtAA:FKchFXF2MI9OsPqanqxZnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259059, "uuid": "8385c7a1-acbd-47d2-b7f8-f08b6467b05a", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259059, "uuid": "1cc494f3-5efe-4827-afb2-fd8dc3c77b4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259059, "uuid": "3e5bc656-abe8-4443-add2-3cac323a3e02", "value": "aa4b82d83212960aaec13ed5794da8e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e0d006-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258253, "uuid": "495e48db-6147-4952-836d-7fa3c96c6e7c", "comment": "Malware payload (RedLineStealer)", "value": "a894ea265a921c1bfc2644f1ad1258c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258253, "uuid": "c64c8eb7-4e66-436e-a2dd-e13cbd80bbee", "comment": "Malware payload (RedLineStealer)", "value": "ab95ffee8f95fab2eaa1ed01bd45ca2218df254fa86ee84e4eba1e36e62deb55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258253, "uuid": "e2bd96d4-9c4f-497e-abbd-5cc320e563bf", "comment": "Malware payload (RedLineStealer)", "value": "495394abd89e4a27ba3aaa3f73c5f363989c8a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258253, "uuid": "bb3c7577-9436-4379-80f8-46487dc03a20", "comment": "Malware payload (RedLineStealer)", "value": "9661436093fa01a4a2c6931c0bc075d85e28872e5b7f2a50d31b62d135af98246fba141eef271714f499bb9c9d1c5a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258253, "uuid": "80ed7439-746b-4a8e-99bf-0ee6592e2736", "value": "7484AF11F7A0C035F2F762F446B993ADA93E7AA16B7050CF12D52AEA1A347E09C31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258253, "uuid": "b6c19af9-8cd2-470f-8467-7dec057c5d3c", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258253, "uuid": "f0b2630d-037c-4b48-808c-91ca94171808", "value": "12288:/23ho6iJR4tyK8aTHdc9AxRQ0iVHP5QPul:/8o6iJ9+THdECQ0Cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258253, "uuid": "452f4287-550d-473d-a2ba-46d50702531c", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258253, "uuid": "05f2ce71-7eb6-479a-9734-7b05d1e1f164", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258253, "uuid": "47b6cb03-5cb9-41fe-b61e-824879a2bd06", "value": "a894ea265a921c1bfc2644f1ad1258c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5daa068-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258548, "uuid": "02c124a5-a6c0-4b23-9b8b-18b18d9cd80a", "comment": "Malware payload (RedLineStealer)", "value": "12f3042698448527d6108ec8d6fe746b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258548, "uuid": "82a9e367-25e0-4b34-ad84-5581c80c1ddd", "comment": "Malware payload (RedLineStealer)", "value": "ae52d2f4e14221b91efcf31a18b1f9e288ee2d342786e8250a7b6ec25833d148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258548, "uuid": "a34351da-a9ab-47dd-9243-6c6e8f03d3c0", "comment": "Malware payload (RedLineStealer)", "value": "4fa49082ed7ac374053d30aa3902ea18edb72f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258548, "uuid": "6fcc6ccf-7617-417e-840d-8d03cb2203cb", "comment": "Malware payload (RedLineStealer)", "value": "403d1b96b8e09a3e74889046f53d7dfc41f38a81a96176b7b3d1c8d5803c3291ec2d7b201c1ecf8126b7d1cfee95de8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258548, "uuid": "69748c36-59b7-4c94-bd44-1257c475a19f", "value": "8C84BF11E7A0C035F2F762F44A7693BDA93D7AA16B2450CB12D52ADE0A347E0ED32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258548, "uuid": "4ab22729-aba1-4c88-97bd-bb37364d35fd", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258548, "uuid": "6944bb78-6dd7-42f9-a261-9adcf9381be9", "value": "6144:ug12XIEoaiJXh4tWOGhK8Y0+t3mRnooVFaY6K4mdAQ3cbROtn8out01KriC:B2XhoaiJx4tSK8Y0I3m2YBp3O0tnBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258548, "uuid": "c9178bcc-9b77-4825-b396-1873be9f125d", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258548, "uuid": "a25ecc25-9931-4f4c-b2dc-8fd5d030bd8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258548, "uuid": "c2c3b422-19e4-4f21-88f8-385fe203bcdc", "value": "12f3042698448527d6108ec8d6fe746b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d235984-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303148, "uuid": "7732c7f1-ca01-496c-8e7a-706cdb65c9c9", "comment": "Malware payload", "value": "828a3b556166a40b313056943c7bc979", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303148, "uuid": "51142c23-de78-41cf-a641-4abaf06939ad", "comment": "Malware payload", "value": "aee477aeadc468aa5220219596a7854c0042a019d96b970d6c2bbbb80eb7b99f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303148, "uuid": "c5d5d06c-a229-4a1a-beb5-fcaf79e1b571", "comment": "Malware payload", "value": "e8eb7b937293a31564e08ca2f5dcd7deffe2ae5f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303148, "uuid": "efa76fb8-a6d5-4f2f-8aa8-fa5327e35e7c", "comment": "Malware payload", "value": "6d2f2af024dc9df4f03070a69145c110cc417569e3fc3196a91b033ca5870ebfbdd136ad00e105a45ebcb99748049d16", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303148, "uuid": "730f037e-e21f-4cef-ab9c-b080ad5efa06", "value": "7133B008F112DC60FB6FBD79A2FD60D066A707B4F3905CA16884B21D49B11AD8B6B7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303148, "uuid": "85b231ce-0b9f-463d-a5e8-9cf04e4af745", "value": "1536:/MvMNcQ+JpmQIOf7SieU6ZDvxjxcpAr/USvhWzUC0zj:/MUNcCWSiebvxju4/UchWzD0zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303148, "uuid": "2201dde8-9927-43a7-a7fc-3633ee36fc2a", "value": 51314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303148, "uuid": "b4725e41-cf12-470f-989f-c8fd169db8c0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303148, "uuid": "a302a758-6120-4674-b94e-5d2813b29db1", "value": "document_06.21.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68079ba5-d2bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624299220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299220, "uuid": "8e67d22a-37be-4d52-8a1c-de5acea87669", "comment": "Malware payload (Mirai)", "value": "952637ab6b7f9a200649ea4039c28082", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299220, "uuid": "12daecc0-29f5-4214-8c35-f49a69691314", "comment": "Malware payload (Mirai)", "value": "b061be343561604ec714d3794fb19259c3d6c4916f95840702fd1c9d6fe26b7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299220, "uuid": "75e8bf62-983e-4853-951b-453372d094c1", "comment": "Malware payload (Mirai)", "value": "ea9aeaa59ad463aa1d75a4dab96acbcc0f9c2c89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299220, "uuid": "b8ded9c9-9e6b-49d7-b85d-d1fb76d93c98", "comment": "Malware payload (Mirai)", "value": "5e4e839ee7e1a4b034f8be32aa35bb6807e2d437af358eace33f2e49bbdd48bfc021008d657f5c7730f23d3d436236dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299220, "uuid": "61a28766-f470-4613-8d82-2b32ba3f36ae", "value": "0CD2E1026641FEE1C5B00631E8278A5B72267D79D1D134FACB3C0EFCA6E9A1D47F8942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299220, "uuid": "97bc4235-9580-47d5-96ce-3e9311f45433", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgZ9q3UEL74:WRwynNIOQQ1KMwML0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624299220, "uuid": "b192f1c3-a399-4d1b-85b6-d4dc01c22edc", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624299220, "uuid": "3a7e80ed-6fbd-4fb4-a6fc-f3a8d2992253", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299220, "uuid": "0f5a88da-d69d-409a-9587-2f518562a3a5", "value": "952637ab6b7f9a200649ea4039c28082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7fb036-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303197, "uuid": "00242750-8eb5-4580-99ff-83fbb08ce720", "comment": "Malware payload", "value": "3709ea060604f98592a050c36a504e94", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303197, "uuid": "18896ef7-b316-440c-a86b-03858e7cfa75", "comment": "Malware payload", "value": "b1052b1555c64fa125026a80600dd0f97919d8f1ae5eddd447084f030f267796", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303197, "uuid": "6706b6f0-c5aa-4400-8dd3-ffe6b5b1c215", "comment": "Malware payload", "value": "0b1aabba6fc756045ed46e7815528d4e769cdd73", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303197, "uuid": "0ee3d754-0e2f-4e40-8bda-60d60eb24af3", "comment": "Malware payload", "value": "51fb616f0e032df6189d8fb18ad01cac02e1978a58ffa7d200c83935584dc000dfb3146c34d4b2cea5ab26784d897684", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303197, "uuid": "4bc45822-ad96-4361-b87c-704f1153d7c0", "value": "BF33D108F113DD60EA2FAE7892FD50A126B717B4F3A09D926894914D4EB106ECF1B7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303197, "uuid": "567db8d3-8e6c-4b9a-8699-eb4a52321716", "value": "1536:/Nae44os/QIOf7SieU6ZDvxjxcpAr/USvhWtRYk:/es/WSiebvxju4/UchWMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303197, "uuid": "8e65922b-6202-42a7-a862-65f9555f301b", "value": 51382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303197, "uuid": "a6ff9ac1-4d50-4ff2-a9f3-f9004f5fc01b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303197, "uuid": "0cdb51b9-d39a-4a48-839b-f51e21dd5263", "value": "legal paper 06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56ec1c2-d26c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624265071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265071, "uuid": "906ac9d0-21ee-4b77-9b48-701c3a0f0a39", "comment": "Malware payload (NanoCore)", "value": "d4d69213a4488819ee33233d8af9ffc3", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265071, "uuid": "79b4ef38-89c9-4205-ad12-02ea0380f9c0", "comment": "Malware payload (NanoCore)", "value": "b19a6910112bdf7fcca247c7aaafa13504b410933dc858eeeec2557b5c4a9142", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265071, "uuid": "b0efe763-1ad6-4ab1-8fe4-15e45c0b1320", "comment": "Malware payload (NanoCore)", "value": "8dbac65f1fe5843993353dbaece85ba8a37f7218", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265071, "uuid": "27203456-c7cf-445b-b0de-4e21426b6e5b", "comment": "Malware payload (NanoCore)", "value": "b74b842708d917a3ae08d1491ee143c17437f2419690c0f188f5c2d33e817e3ea3dd53079982e486f90a359975ac8f41", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265071, "uuid": "ae31aac0-77a3-4903-9d1f-09a4af275089", "value": "8B45129D65A40B36F95A52FE8705CC0087A96C2B75A9B1732F8E7933F0F67A0D1E2434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265071, "uuid": "42df6f06-0c1d-4767-b79a-f736a59dc6ba", "value": "24576:CmuDaRc0unoXlDhYinZ21E4RkveX3pVcL/D2U0OtR1/v3/K:CVcunAlD6G4umE2Ut1X3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624265071, "uuid": "a4a325a8-1968-42d3-9083-6da5b9f5261f", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624265071, "uuid": "3fa25bdf-e91c-474a-8f7f-262464b28f89", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265071, "uuid": "e6389900-9d3c-4f8b-be06-5ebbd54df27a", "value": "CI_PL_BL_AWB 988-33669786.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e5a80c-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303409, "uuid": "d7052e91-28dc-47bb-b547-6b1ca84877c1", "comment": "Malware payload", "value": "414c4c72ca8299348a5ea1bb7b47fb77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303409, "uuid": "8751bf24-c5f4-4224-be1f-9b82683e6b22", "comment": "Malware payload", "value": "b22f34d357f1352244f7d51b3ce9cb7059894db41771012a5e8ead8385799f82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303409, "uuid": "190ba7c6-3dc9-4efa-867b-0dd6a6426cf9", "comment": "Malware payload", "value": "165597c5ed51e7868d26386774b28f0d53738bb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303409, "uuid": "8e0fbf1c-3a85-4133-a022-dafa07d8876b", "comment": "Malware payload", "value": "776be0f94f9bc9e96db4ee42b7cadb12814cd2f4266a7150998c5291df843126f294bdcf409661ee982904d181cdd4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303409, "uuid": "6e80ddc6-70a5-472f-8521-b7cad944d579", "value": "F335BF220ECF422DE2754FB557B0BC87C2B6ADAA3705A2253DC031ADC9335D9D9EE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303409, "uuid": "914c2919-72a2-46ae-8fbb-d3b4077bfbba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303409, "uuid": "a9e6ce0f-ae3e-4581-9c56-7e572dbed11b", "value": "12288:DWBWFHmsDSMPQipP5MfLV0vyf3pMxSbjvMTt+d9v2k0F7J0v02ZpSiB/oI3WgwvE:qWHgipWTf3p7cI9viJJEZpSiB/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303409, "uuid": "b856d846-cab1-4f8b-935f-16438f3e81dd", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303409, "uuid": "7d37c3bc-e87f-4ecb-8aab-1695b651984a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303409, "uuid": "fd84ad66-a424-49d2-a414-40f4391b19b1", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d6772a-d285-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624275515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275515, "uuid": "3db065bd-998d-4f69-8af6-bb763f95a1d6", "comment": "Malware payload (BitRAT)", "value": "452bac7c60bc10c0a1f483848a6d278c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275515, "uuid": "80c6c35f-077c-4ba6-a4a5-261d3d6d51f9", "comment": "Malware payload (BitRAT)", "value": "b287146aa5bc1a100bd475d8a1a0fd61f9910dd514b4e11dfb62ef4cf769cacf", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275515, "uuid": "b7003b2b-7294-4668-8a99-360e0e4a43e6", "comment": "Malware payload (BitRAT)", "value": "8163903a2bf4e7cf766598589d57af014154e048", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624275515, "uuid": "2c221ff1-62fb-40f0-bce4-aef8704556e8", "comment": "Malware payload (BitRAT)", "value": "d0b736732a670df2d888574a8a8dda8b2db3b90fddeb6c203665f513bc69a8f545c1bca7355c16c2dcdc9ccc697daf34", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275515, "uuid": "84b43ca3-8a88-46be-8057-fb50a74b5461", "value": "FDE5330275715CAAFCAB30379E679971F180967604F18346E3217F4FDAD3690AB36643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275515, "uuid": "59ca5640-5909-4953-8f8f-2674fe3f5454", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275515, "uuid": "ee1f679d-3270-4963-b08d-08a6e89c3523", "value": "49152:Dv3WyX75gIdnxwqtQ/Uqw8ob9cEzrhs+vrC7j/e3nLmHl8QYi+UoeBnuEm1z/3Pg:D1X7WRJ7Ezrh/vrC7jG3naFZYi+Uoe9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624275515, "uuid": "e57929af-ba7d-437b-bb3f-8bacd876eed3", "value": 3071108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624275515, "uuid": "30c150df-09f0-4187-9569-b776f034442c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624275515, "uuid": "84674489-3ac0-4917-bbc3-eb68d3d37518", "value": "Booking Confirmation 06212029746647134765750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0e055c-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624314957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624314957, "uuid": "dae9971a-bb75-4ef1-a031-115c2b08231d", "comment": "Malware payload", "value": "60560a4a61799e6ace034aaf00edce1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624314957, "uuid": "9c53c86d-f7ce-4d65-9101-ccd4c23f8dc6", "comment": "Malware payload", "value": "b2bcfaa1c096fc4399830da4bdc16748020b6a98426bba8a1bbad18df82e4335", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624314957, "uuid": "ed8b8c39-bad9-4539-8029-0c4ad4ed91d4", "comment": "Malware payload", "value": "cbdb56f9247c9b37697f729c937902355ee28f47", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624314957, "uuid": "9aeb08ad-35f4-4f82-bf0d-8dd637133012", "comment": "Malware payload", "value": "b54dd630d6878a8b79071a5c71e8b6b15e5f695fccd1c6f36f2b9d2cc0d47804d60de706ea5915857d64ce58bad1e771", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624314957, "uuid": "388a9b71-aedc-4033-90e3-6c86e32b789c", "value": "A404D01FEAD706CDE337AA333A5D732B62C45612DF19D0A9CE14D2FBC1B14904681A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624314957, "uuid": "84351ead-0513-42ad-9eb2-cacc0c9fa11f", "value": "b380277cbb8ae5571489cb34552d83fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624314957, "uuid": "58cc6c81-0008-410f-b9c8-8c3fe1dbc844", "value": "3072:guCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:MzWxkOP4p2EesvcDi6DOHPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624314957, "uuid": "768a8926-a5b4-4f5c-bb85-0a29ad13ef4f", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624314957, "uuid": "3461f3a9-1024-4738-8a80-3ee2a0189e1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624314957, "uuid": "515a9ce8-ae17-49ed-961c-f6162dade2ab", "value": "47uP6N8ql", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b91290-d2bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624299241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299241, "uuid": "75baebaa-8d74-4cc8-be54-71974f6b8c4e", "comment": "Malware payload (Mirai)", "value": "5c43a3853d8948094ee7e1b629939d28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299241, "uuid": "38327b98-3dff-4370-88f0-700ba3b36a71", "comment": "Malware payload (Mirai)", "value": "b3225a4f41727bfb57304aacc35442aa6094ae9f1077b1137d57e0fee1db594a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299241, "uuid": "f11a8d82-7978-441c-8a4a-2df2a7b3a819", "comment": "Malware payload (Mirai)", "value": "cddc0e3c3d95fc877b22fdd9b484e15a3d586235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299241, "uuid": "0c9d7f43-2403-46ad-b13d-1179da1d87ef", "comment": "Malware payload (Mirai)", "value": "90a086650fe0dcec72dc3d4c97bd8e88d8fdfe25d8d894ee7716ff17c04d2844f6dd8057cb4bfe65c0a5cd858eda6b88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299241, "uuid": "c5b90e0c-54b5-42cb-90cb-3362bfa418ea", "value": "93A2D01821CDE962D170903AE23DC347AEDB47B652FE322E1E08079DE49591AD3BE945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299241, "uuid": "830bf82d-b560-4bb1-a3b7-fc4ab491e21c", "value": "384:YD5mog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbThymdGUop5hXl:YDgoh/DxCvhdR4IjWVFbSXs3UozJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624299241, "uuid": "ea773970-5f92-470c-8f4b-cfa36d34e1d1", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624299241, "uuid": "033baea0-af34-4a3f-a0a2-c833d317c5ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299241, "uuid": "d97e65f7-837e-4e57-9836-953da90191b3", "value": "5c43a3853d8948094ee7e1b629939d28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc32ee8-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315171, "uuid": "f713eab5-018d-4fbd-8c2a-279d76cd8acb", "comment": "Malware payload", "value": "af6d22995d748667b519db8b20a467d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315171, "uuid": "792d4989-4a5b-44d0-bdd6-d4f56593051a", "comment": "Malware payload", "value": "b35d8aaa8d0fc82e71782c157ec1f7ba87df914536e7d2e6d5d7ec7a36122933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315171, "uuid": "bead45a9-aa5e-421e-a30d-3ddc6dee0553", "comment": "Malware payload", "value": "c8248adc8088b882a2838771efd8bf125efcf412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315171, "uuid": "fa4ac485-9857-43e6-83d2-858627d6ab4a", "comment": "Malware payload", "value": "e91c6cb38c6a0ff81c914a816814c90ee657234467610cfefbeebde744e5ae308f8908b33a95936f04a9ce590624202d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315171, "uuid": "f1b949e6-da62-4a93-9326-f615f3eff5ca", "value": "F264C30AEA4B4176C7FDD3BC506DB53BC85A0E09A9F337C537B29061D69061B6CEB206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315171, "uuid": "e45ad6ea-f71b-447a-9534-c5df1f1903a0", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315171, "uuid": "5c9a5bb2-4836-4826-88d3-9336af1c809f", "value": "6144:z1cQ7Z6QNqj1aO5Fm75Aeu9J5wjDcROFXnz4jtm7rNLt:xcQ7tN6aO3m75/u9wHCsXz4pm7rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315171, "uuid": "451642e4-c8f9-4a75-acf7-f29ca68f37a7", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315171, "uuid": "5c055a22-476d-4369-b261-312c4b611eee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315171, "uuid": "bb773621-3167-4a1e-9ec7-de2c6eb5c2a8", "value": "b1J6TLPo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed078bc8-d26c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624265083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265083, "uuid": "53f95a04-199a-4f17-9149-54b0f3d6a463", "comment": "Malware payload", "value": "41b0b32b825d84ded55b8376f0d8198e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265083, "uuid": "b6289629-f712-4505-99a6-b273fde05b22", "comment": "Malware payload", "value": "b3838dc2b59b83d2d15142b5d5225dec43ef4e61e8a31f074951785204fb2f13", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265083, "uuid": "ba0c900d-9615-4d63-ba01-c7c7bb975e3d", "comment": "Malware payload", "value": "a17ea0b2bfeff9448bffbc59d634489235e92ed3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265083, "uuid": "ee80f664-52f9-4031-95c2-640146509f88", "comment": "Malware payload", "value": "4b0596a7eb19960871bd0353ce2d0c44a661f443fb93369511b4be968c896aad32d02c94c20b75b66f57ea5dc99dea59", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265083, "uuid": "96a027e6-a051-45bf-8258-f64dd06d6e5c", "value": "03912858AABC0D83CD078116C4B9FDA50AF3F0524FCF28D032AECAB1077A3452917C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265083, "uuid": "ea2ce99d-0245-4d37-b7dd-106004a7c867", "value": "96:8jEUvwfrKmDGSiUJRKJwSVYPX+VpS3NHH1/wMHCns3fdBR4oPKC:8jE8hUJkJcX+Vs3l1/w5Mfei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624265083, "uuid": "42e6174d-133c-4aad-8ceb-9e401765124d", "value": 4289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624265083, "uuid": "892cad7e-6aba-42ab-b04c-955ea093f795", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265083, "uuid": "e80aaaff-0f04-4010-9a48-e846b52c734b", "value": "Items For Quotation .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c20170-d295-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624282548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282548, "uuid": "a243a770-1ac1-42b4-9b55-36d38134aa06", "comment": "Malware payload", "value": "ba7b68208aa11957836d288858e3d00a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282548, "uuid": "cea87e90-795d-4617-ad21-7f715d55a4af", "comment": "Malware payload", "value": "b4bbbd3c1eec71739a89667c8a74e2587a394cf1a11045a169927ebcc3dafef8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282548, "uuid": "b8e10182-f5d4-4695-8744-1802fd1f0d37", "comment": "Malware payload", "value": "9020cf6b4399ac42920aa48d2a908e93a7f96a24", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624282548, "uuid": "153ab189-9b9f-4329-9a3f-4e503b7864b6", "comment": "Malware payload", "value": "8553097521ded9ecadceaad99f0a1a6de4dbbf53158ef98e920c0d4f5239f6f5bf5c7901de250f7d9d3c6ff8bb9ba601", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282548, "uuid": "94157bbc-b086-4a96-b26a-72c26f931953", "value": "1A71E7E1135C2941DE1AC5E365B8FC7A0399F29289CB07C4B28CEA72076B71197B5893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282548, "uuid": "eddce5ea-40d7-4a1d-b1d2-e3853cf3a17b", "value": "48:X164fQI2/RXnL9sGfs0P7BpsRgkn7kUlrX3SIkaMpma7h5a7DbW3H4o4FJTIY04k:lpsZnL37OgkdpFLoa5mNoQiiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624282548, "uuid": "e9045b85-2314-4813-9e61-6de94df6211f", "value": 3620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624282548, "uuid": "07be22af-787e-4f10-a009-f1c0c2946463", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624282548, "uuid": "cf14015e-320b-4055-9c96-3cae2bd023df", "value": "004522-2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29b68c1-d25c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624258221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258221, "uuid": "0b111cf6-2a6a-400e-9244-461fd14e15b2", "comment": "Malware payload (AgentTesla)", "value": "0f06a4b4229661fafdafab32486cc577", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258221, "uuid": "d6ab0ae1-eff5-4455-90cb-0de0c39a6184", "comment": "Malware payload (AgentTesla)", "value": "b510cac0ff556722dab781245bfbc11c2d6d2741d87a0c2b6c0158c42965a80b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258221, "uuid": "02d89599-f9d4-4bf5-b7fc-cbaaf41dbd19", "comment": "Malware payload (AgentTesla)", "value": "44ff7873af4b02f2a6139d5b739b34d6ee391d17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258221, "uuid": "75191031-d625-47da-8ea8-787a31bf5333", "comment": "Malware payload (AgentTesla)", "value": "5e11e082d01133b609e7dd24e6bec6d5bd5e1214a824e4ba84742c0fee162cb293cb1aaa1246dfa5add23fa22eedfacf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258221, "uuid": "00832953-c1fe-4fc0-8c0e-de339f457afe", "value": "1545125B9B88CBDEEFABA532C6A04DA8C0497F4C9F50B15B418FB3570D639744831C6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258221, "uuid": "93d5028a-5c1f-4235-805e-f5e187241f73", "value": "24576:POzvBUskbe9VAznnEwppUCTkk9+3evlTzgkNbQOwOr7FacGfnDP:ivBmbOAznEMpUCrQqbwEoNDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258221, "uuid": "b4f95ae0-7810-4a9f-b414-761f390a1ca8", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258221, "uuid": "3e41d6f5-c7c2-43ec-baef-64af0bf718a4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258221, "uuid": "7a4592a1-cd7a-4f79-af68-935a63181220", "value": "Sonix 355 - QT-000969.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9330936-d2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624311060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311060, "uuid": "6ec2e87c-9a7b-4f21-b4b8-264e3a87f9d8", "comment": "Malware payload (Mirai)", "value": "6f7d136453d910e2fcad8dc87bd2da6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311060, "uuid": "2a256563-e7cb-48fa-8a57-0e7800bb44fa", "comment": "Malware payload (Mirai)", "value": "b5592d0d6c41df3ae2d71f588b594a278285364a3f03ddf203c1354e9d79a2bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311060, "uuid": "97b5632c-94b9-445d-9b68-aa7f9dcdcfb7", "comment": "Malware payload (Mirai)", "value": "dd2e4c7b35a01f6162f7c000eabbe85fbffa755b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311060, "uuid": "4938cce6-ae6f-4c2b-a069-83c7c5947ac7", "comment": "Malware payload (Mirai)", "value": "059131dd56ef633841afcc236e473eabf363d78fa3de14c640ddc920f0bbd933d4b749a7425ddba642dc1c97f560a308", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311060, "uuid": "1ad4c67f-9908-456e-904c-f0e0e6602e5b", "value": "1673E91E3E219FBCFB9C863547F78E219658379626E1D244E19CE9011E7034D782FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311060, "uuid": "05b22330-91b5-450d-8710-c574e5ba70fe", "value": "1536:DVNTbO/1DFTxp3iFJnADG0uGbohyj8LOlLYhcnJf8bRwPg:DV9byz3ibADG0uGbohLmLYhIJ0gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624311060, "uuid": "bcb2d953-e465-4975-993f-efbd72538af5", "value": 77316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624311060, "uuid": "ea2a9ff9-a166-4f8f-823c-633d97a39d3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311060, "uuid": "751a5aac-37fc-4329-9416-7e425a61aeed", "value": "6f7d136453d910e2fcad8dc87bd2da6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e9de21-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624258891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258891, "uuid": "69e481de-294d-4718-ae95-1360e3c54365", "comment": "Malware payload (ArkeiStealer)", "value": "8f2f4c47362bd1ce0cbedac9517df620", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258891, "uuid": "684b7c2a-1756-4a5a-ac76-c8581bb82554", "comment": "Malware payload (ArkeiStealer)", "value": "b55dd061a60905c3a2208917883d326b08a3a7d1f8fdb94f78e6675375fc8219", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258891, "uuid": "e08957d9-cdec-402c-a3ea-56b14ed4cc09", "comment": "Malware payload (ArkeiStealer)", "value": "489c4ce570686c42319008ce645cfb8b3e138e71", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258891, "uuid": "9d33d6ca-e2ee-4255-86f7-ab202bafe7bc", "comment": "Malware payload (ArkeiStealer)", "value": "98cace5b4190e781f71cdccaa663e266d918d080bca9279b92fe3ba2e7b71fa2bf172d829824d6e15616fd751d5f07da", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258891, "uuid": "24ba8244-0d1e-4575-9861-0105b6050f9d", "value": "42D401C277F5059BDBE863B2409311B11B716E297E81D6C92CA4222E0CF67CEB912F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258891, "uuid": "e64a3113-afc8-421f-bf26-d57c73392664", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258891, "uuid": "91303433-6fa5-42d3-b06b-40fe38b34cac", "value": "12288:Om2+nUf8ukQ4aOqP9LGCtsNc/l/PH3Hwu6rCPUh/tmq:Om28f5goCtsNml/PXHwukCPUh1mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258891, "uuid": "e2527d77-282a-4880-8f81-f5a7233c0c96", "value": 621840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258891, "uuid": "41b24256-0345-4e68-9f6c-7a3b38706c13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258891, "uuid": "f72bc5c8-aff0-4fe5-be57-8a0b1688a18c", "value": "8f2f4c47362bd1ce0cbedac9517df620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e15121-d2eb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624319594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319594, "uuid": "2234863b-23c4-4148-baf6-a2825eda783b", "comment": "Malware payload", "value": "0ba1b2ed9643ba0d0d949e9c2c7a27af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319594, "uuid": "9cfc579e-8d60-44d7-9226-f9980791ee3a", "comment": "Malware payload", "value": "b6868bf6126b8450e2863450959b4d8889d96e10e0f472de0d7269b3c8eff4e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319594, "uuid": "c5c662f6-3eb0-4470-a569-f1decda7ab49", "comment": "Malware payload", "value": "654b6f56c8b6a64d439cd7c65e32ae616cf02a36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319594, "uuid": "09c16fd2-c09f-4405-8957-7262b430f237", "comment": "Malware payload", "value": "0edeedc16d744760fd8014bffd5cbede1b2070920a66edc12ba857bec7e3db0cbca29df56eb61e3a33bed208a550cdcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319594, "uuid": "1f354b18-24c5-462a-beaa-87a0b8310784", "value": "9B64C14DCA8B417687FED3BC106DB93BC80A0A1DA9F736D537B29461D69070B1CEB209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319594, "uuid": "52961220-2c8d-41bf-9d31-1b9071903d8d", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319594, "uuid": "b09e20d7-aa90-45d4-b957-ed951417bd4f", "value": "6144:01YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:KYlNRmFJC8y9hrqGdVt5rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319594, "uuid": "c5067341-7dbb-477e-b894-b9453066e238", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319594, "uuid": "908dcc24-f861-491a-a416-9d952504c5a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319594, "uuid": "489ec656-4bab-4fea-a08d-c3eda5b9c878", "value": "0ba1b2ed9643ba0d0d949e9c2c7a27af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9225ce7-d2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624288297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288297, "uuid": "ed868986-f4f5-48b7-9f55-23ae19586169", "comment": "Malware payload (AgentTesla)", "value": "db07493f8abf7e85974575aa9ad30406", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288297, "uuid": "0a7a161d-3609-4f04-a669-9330037633ec", "comment": "Malware payload (AgentTesla)", "value": "b835b8b0a5fb2e1020d4681444d010b8b48325b5aa8335750a03880813ecccd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288297, "uuid": "730e4d75-d684-437c-bacb-0be245dafc32", "comment": "Malware payload (AgentTesla)", "value": "9f0e87b7a433625e6701e4449bfa4003fedee41f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288297, "uuid": "14fd77cf-61ca-4305-9f80-95021b2de148", "comment": "Malware payload (AgentTesla)", "value": "8720620a28eb1014c3df78e02b5ba756c1d3f06a96874a6c6cc971ea96954e2ece294046dc68ca51ae23f0ceab6ca1c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288297, "uuid": "193aa096-a8b3-4b53-b49b-57bca303bc10", "value": "84726C519FE00C91E4768A3179F917012F35B7A79D02C65F265CC9480F93722A776E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288297, "uuid": "c2b5c350-f596-4ef8-8c42-994184a3c739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288297, "uuid": "60824fb7-0652-4875-adac-e524e46389ba", "value": "384:cOWBfzayzeLL+pw9Tp58iEXuX4y9YZiY0jhqRX:cOWsyqV9n8iE+TaZiY0jhqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624288297, "uuid": "187b5cf6-b0dd-4a77-ae83-d270706015c9", "value": 16576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624288297, "uuid": "2d824df0-428f-4b37-9289-e5a8994a6330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288297, "uuid": "8b527685-9f1c-4f53-b719-d911d84cf624", "value": "db07493f8abf7e85974575aa9ad30406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794355ed-d234-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624240837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240837, "uuid": "4a5a219e-0bac-4a44-b39a-85235b96a360", "comment": "Malware payload (RedLineStealer)", "value": "c3837419dde91777572b67d7d0b71385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240837, "uuid": "e142a55a-5fa1-4df0-8d5e-0d4fb4780c0c", "comment": "Malware payload (RedLineStealer)", "value": "b846605e29237f34f7275f9a98fa26617ccc4737c81e3ec75cacb6d2a245c507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240837, "uuid": "3c5714b7-8af7-4d9b-812f-7b086b008056", "comment": "Malware payload (RedLineStealer)", "value": "ceb037c1f969ca3c00b9f705a71112d478b6857a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240837, "uuid": "2f245b32-4cd5-46fc-8109-05448d11f287", "comment": "Malware payload (RedLineStealer)", "value": "787e948aa4c88fcc36b64ec2f666f762d57898d14e630c5dae1b6aea656f55438ed5506c91073318bf014f6c3ca74ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240837, "uuid": "000187c2-6af9-4592-ae85-9f9891068ab9", "value": "E494AF10EB90C035F5F6A2F85AB5C3B9A52D3AB1972450CB52E52AEF1A347E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240837, "uuid": "94ea07f8-070d-49a9-8564-26ba054a8b66", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240837, "uuid": "7268b7ed-3dc9-4b50-8daf-fcbc00ef78a0", "value": "6144:6d3EkIylHkBguDmST1ppwekWO6JDqw3dZ+AwwOmWEPiOOOW5g1FOx0HM0rKri:3kllHkBguiShp7kn6Ew+9V7IKbgvZ5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624240837, "uuid": "afabdc41-9022-4003-a783-cbaf6dd66800", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624240837, "uuid": "ca1e6640-1528-4cf0-a17e-af0c36fe42e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240837, "uuid": "dc3132dc-0908-47b7-8527-598ab73bbdd3", "value": "c3837419dde91777572b67d7d0b71385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59508118-d2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624310792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310792, "uuid": "449213ba-3432-4fb0-a024-c8b691e22031", "comment": "Malware payload (Mirai)", "value": "b9b55bd26d6c50aa9309704d4cfffd4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310792, "uuid": "30c17a06-8bed-4e4c-9390-44dbd7f3891f", "comment": "Malware payload (Mirai)", "value": "b84a8a94986660bf3b2a8058fbff569312fad1c94177455707f509afd3219ba2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310792, "uuid": "c9ffb6ab-0f53-4357-b2e3-64cb12172d3c", "comment": "Malware payload (Mirai)", "value": "7b71735d7a9c7b7bbb9c866bab808e2aedc9d807", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310792, "uuid": "5ae665bf-45c0-47cb-a32e-cec9bf54eaab", "comment": "Malware payload (Mirai)", "value": "921996083986f42345a99f14e9c09659af0c490c5aa323ed0b1e6baa3eaa69000ca7ff66f7382028211df807f9e4bd78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310792, "uuid": "293256eb-e9b6-4d38-85fe-23de3e3a45c6", "value": "7C331992B8D29A26C6D023BAFE6E518D331163E8D1DF3217DD141B193ACA51F0EB7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310792, "uuid": "c56e59e2-d82a-406f-a291-862bb41fbd7d", "value": "1536:LXPneY/Nzwi4amCy5QSSsVaB+r3S5yQ0PySt5Ac4EwP:DPn1FeGfsVa8riglqSt5Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624310792, "uuid": "a7cba1ab-c903-4a37-9cbe-6a958345b839", "value": 52456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624310792, "uuid": "152f18a7-6c39-40f0-b8e5-49be4858162b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310792, "uuid": "d2b72907-73a4-4497-b525-e129648c1d35", "value": "b9b55bd26d6c50aa9309704d4cfffd4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7b277a-d2c3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624302128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302128, "uuid": "ed86a1cd-c651-460f-bb72-56e71fc893e0", "comment": "Malware payload", "value": "e154fd56e045d61b5f03e9393dd151df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302128, "uuid": "fd0a4c61-571d-437a-a624-0092fd3ea24c", "comment": "Malware payload", "value": "b8e8ae320ead014c770d55d2d024de5ba15b5759b7d42f305ae4a72891bb88fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302128, "uuid": "87d4deb2-0fd4-432c-8c76-0c080da9e990", "comment": "Malware payload", "value": "659c980a7f0d712fae93a489cedab015dc67f7f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302128, "uuid": "de8332d4-1d6f-45ba-af88-6bb2ce6ae6fd", "comment": "Malware payload", "value": "7c68c23fea1a478575f5b8376abac96874c94df78ec9abefdccfa0cdcd2d2539ab3ce6020b0ef6f4c007bc90c1ef2b17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302128, "uuid": "364460a6-8cd9-45a3-96d5-27e1b8d964e1", "value": "D8F37D839E615FB7C3096BB15DFB1A344716E5600F6F1E896438AAF0520F2CDB40FA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302128, "uuid": "f8831f6a-e123-4d8e-8be1-898fba2cb8ab", "value": "3072:qvYb92VQSoK2HIpXkU5H9rDy//QlA+TmXuHWN7zrjpxxkuu70h7iX/:qvYZOcHImsdyHQYX/Jpxxkuu70h7iX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302128, "uuid": "0570df7c-1a4d-4741-bf2d-17e4ff33905d", "value": 167082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302128, "uuid": "6310c777-2337-43a9-960d-cf6a9f46aa5b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302128, "uuid": "1187c33d-4695-4728-ae2d-9113a6221caf", "value": "e154fd56e045d61b5f03e9393dd151df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43212f03-d2eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319345, "uuid": "0a929239-7819-40cd-9082-9d311292c302", "comment": "Malware payload (Mirai)", "value": "305865b1b8dd699b404d88a2c846d259", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319345, "uuid": "326e7582-81f5-4879-8df4-713ff8320472", "comment": "Malware payload (Mirai)", "value": "b8eaf2dd8a00d6f46010c46d900e5b20774496216da950a7df8d10979b0a2fc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319345, "uuid": "642862e4-79ac-4262-9f8c-2e61e742d16f", "comment": "Malware payload (Mirai)", "value": "37dfc76d68ce0e56bbf17588099cdd0fa20c01cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319345, "uuid": "e3254d02-5194-487e-96e5-ae35572d269e", "comment": "Malware payload (Mirai)", "value": "3368b50ad587472e32433a3c7bd3b3539cc7ae6aa2be3546ce7c6136d183f4db570dc638d42016f05a539d4053ffedc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319345, "uuid": "a82c58a7-4287-4702-b577-da87331b275e", "value": "BE43023C2213BD519E718DB1DEF6DB5905EC5BB4F13EE4B289A849792CC1D802AA448F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319345, "uuid": "93ca3e8f-f958-4eef-a817-ad54caf7927d", "value": "768:2Up+tV2jefwtobs6ItuI40HRFCKr2ZoPlb9q3UELF4dvBt7k3nXVbpdXXdW:2UItVYtJ6c4yFC02ZoPoLevwnJXdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319345, "uuid": "f0fdfd29-709f-4eee-94a7-299f89743938", "value": 55676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319345, "uuid": "f8840715-845e-497e-8a29-da8cc8c27434", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319345, "uuid": "a12cc78f-e04f-4b18-9c45-dfb5f87bc9df", "value": "305865b1b8dd699b404d88a2c846d259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ec3fc5-d2eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319589, "uuid": "12489286-0ceb-4844-b91a-8c3045026a8f", "comment": "Malware payload (Mirai)", "value": "ded06f906f9a79229f5d33afc96426e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319589, "uuid": "7c2f66c7-858e-4115-b405-82ec733b1e52", "comment": "Malware payload (Mirai)", "value": "b9390789a1e7a2bc416396b83c6af4a99798aaefe830d7a07c2b5e34eff1585a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319589, "uuid": "a8aca094-5b52-4b86-b528-c1095a4c7c0a", "comment": "Malware payload (Mirai)", "value": "b174654461c9e778657de61f956d3d78c76867a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319589, "uuid": "04ded5a2-1457-4053-8f4c-6cba4474062d", "comment": "Malware payload (Mirai)", "value": "961544433f98630f0fe08afbde3625d1ddbf89fb0476ffcfc15c8133959bba785c0ae8dfc4ed0783396f9683ce01f179", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319589, "uuid": "63ed83e3-995f-452d-b997-2ba6b8e78a0e", "value": "41637EB9E1795E54D35105787D108938C723F00AA6DA2EF2DE86868FF99BEE8F004771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319589, "uuid": "d18c5c37-4a1e-4605-ac4b-e8a5fa16cd17", "value": "1536:B/9tdVPQwaEwt+9f66gFN1pSDTZAvj3fs3kSbw7DizQsCsG:BltnPtbVd661DTZArf+tC2zQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319589, "uuid": "5345778e-7f05-45b0-808c-7f064abab2d9", "value": 71836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319589, "uuid": "37e2e1dd-fc88-492c-95c1-4c81b22699fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319589, "uuid": "f0413d31-dae1-480b-9d3e-580b3cc2b417", "value": "ded06f906f9a79229f5d33afc96426e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b7191c-d28f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624280135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280135, "uuid": "ed7b2b24-5f81-447f-8bcb-713c25df56ef", "comment": "Malware payload (Formbook)", "value": "0dad048bdcca8bf6ed361c5451629174", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280135, "uuid": "c1ed522b-5239-4d71-ae8a-2a5ec3bbd3bd", "comment": "Malware payload (Formbook)", "value": "baa24d276686a4ad1e529254922692679899535943ac0993f5aaa6fff8e999eb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280135, "uuid": "c16b4a86-e35d-495f-bd28-0a124b550964", "comment": "Malware payload (Formbook)", "value": "da7af5e13cc0700236c4bb78075b020b029a7df5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280135, "uuid": "88368f1c-7467-4a91-b3ad-832c9af68dbf", "comment": "Malware payload (Formbook)", "value": "cd43cee56d2d389caa87286ab649e8a1a3f1661de9c4c71ad1fe356bfefd7fe2b2bd071350d676de12afa36889c544de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280135, "uuid": "2fc016f5-dd5a-4b81-905c-9f4c9e7054d3", "value": "99E42385492A194BC1A12081CE8FD69137D46FDA1C0A3899C6FD7ECF97D04E8B2B749E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280135, "uuid": "5ba769ae-d728-433d-8395-b6754f972c59", "value": "12288:6/NUjfLYo6q94v+smJkKe1Sbd5KMYGaOjFSddzrJhJA7a+86MYz7DlR:ljf5h4v2Zekbd5KMTaAezrTJARz7ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280135, "uuid": "e1b1596f-32ee-484e-9845-c4dc50a41009", "value": 667697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280135, "uuid": "d6b4e5f0-9f94-4fc2-a7f0-0b60cd5e016c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280135, "uuid": "e4adfa52-03bd-4365-8b3f-80e47944af16", "value": "Purchase_Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288e12f9-d24a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624250151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624250151, "uuid": "f5a15fc3-50e6-4cae-8273-dd15837ea82b", "comment": "Malware payload (Loki)", "value": "eb40fc100294820cf00656e0cd5dd707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624250151, "uuid": "9c91a9fc-351f-4f7e-8a70-6b9ee1b59d95", "comment": "Malware payload (Loki)", "value": "bb0a1c36697ce7271b0e78d81a2b0b66a635bd31c51bc30e2497344bd79fdebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624250151, "uuid": "7e3c386b-760c-431d-aa60-f78eb82da0b9", "comment": "Malware payload (Loki)", "value": "bbad324d54ea954c2b937362a0505db159042152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624250151, "uuid": "b03fdcf4-8025-4873-a4dc-1f97cec53476", "comment": "Malware payload (Loki)", "value": "e2b2558addbe3607176f3f24dc79d1968f1b694c6d14bcc96af576a1b34e06a2c3a0b41c77d647006338869f4f39b4a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624250151, "uuid": "3f6e6bb6-eebd-42cb-9cb9-c376a060250a", "value": "64E4BF7039EE911DF477AE781AE476E29A6F7E537707D95C24E4234A8B23802CF40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624250151, "uuid": "81469f7e-f516-4874-a9d1-b44c7627ccfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624250151, "uuid": "54163a52-6376-4ca0-bfc5-f592ed85ff7a", "value": "12288:7Gn81WFHmscz7AG+5mR+WLsb4oS/v2JmcJ6lnlHhU:7vSHCz7F8osbgv2N6ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624250151, "uuid": "9361741d-28e9-4a3e-ab5f-d64451e67065", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624250151, "uuid": "ad6b7962-9a0d-473e-9ae2-abc099a67f21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624250151, "uuid": "a3807654-6b6a-4f47-b6b2-10982e432c75", "value": "\uacac\uc801\uc758\ub8b0\uc11c_BK210620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d34225f-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624259259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259259, "uuid": "260c0f4e-f0cd-458c-82d4-6cf6fca21607", "comment": "Malware payload", "value": "32739cea5c13321bc96abdf5a8441d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259259, "uuid": "f508a0a1-f827-4ae8-9acb-8209759ce937", "comment": "Malware payload", "value": "bc7cbed34a28008fed6c5c7d7fea8658d4abeb1eff5b06e06a917680d5091fcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259259, "uuid": "5a889482-db38-4af3-95bf-590c158ecb01", "comment": "Malware payload", "value": "2b27c78cd09a996c3aed6554b8eb5b59609d2ea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259259, "uuid": "76b46cfe-5208-4759-b064-6b17b3e8bc7f", "comment": "Malware payload", "value": "812ce3b1be0f5c529ce34d584b4c3b6491f9d6ef48eedc0f933165eb09d4fdfa9c5837143b12617be39d12fb47de8156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259259, "uuid": "bde85444-9bec-422f-99bf-8ec664c6090f", "value": "61063312EDD4A431E6216C728B695B55A43C7C601F148EEBE3C84E2EDA740D1FA327E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259259, "uuid": "6d29ba79-7ab9-4709-9240-c2bfb705f4c2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259259, "uuid": "fee79dc1-b096-46ee-b06e-1b6b6f3c3179", "value": "98304:8bBGqwHBgd6bEoj+jOBUYxyZ+Abuee/D6Q/0eSEBs:88+d6bE5jDYWFbe/OQ/0eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259259, "uuid": "eec830ed-a83a-46a1-ab2a-275161bfff47", "value": 3839627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259259, "uuid": "e7ec8566-e11c-4a4c-ad5f-dac225038368", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259259, "uuid": "a94e9d2c-f77b-43eb-80a7-ef609c2e3511", "value": "32739cea5c13321bc96abdf5a8441d43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3461e08-d26c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1624265094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265094, "uuid": "4279840c-40f5-41f4-941c-505cc683c892", "comment": "Malware payload (Dridex)", "value": "a9cec405267f2d20857975c662091f10", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265094, "uuid": "ac3ef07e-f37d-46f8-96ea-3f5e5d147d51", "comment": "Malware payload (Dridex)", "value": "bc85d3179f469f47031153a274666c3306bbfdbb71bd74eda15073899e16b4b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265094, "uuid": "42bba5a1-4e9a-4c17-a8dc-b24743fabf67", "comment": "Malware payload (Dridex)", "value": "eb5c2850276a10ae20713af3cbbe6d1b37790c96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624265094, "uuid": "a464657a-00e6-43c0-b08a-d687872e07f9", "comment": "Malware payload (Dridex)", "value": "9d971d09e9cb946c176d64d7a7f74984324752f7c0086775425450b7c8c82884e7f0ee322368a2690f00441491683a02", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265094, "uuid": "97416586-e75a-415e-be87-045d22a848f2", "value": "7E650106675BED6AC8168931EC13923293969F142BFB6C47FA807ADD31E87E155323C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265094, "uuid": "3931e10a-3927-4833-8131-9b525ab89c0f", "value": "6935ae43ee15f732f7819314961b3de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265094, "uuid": "085aa929-0d5a-47a6-ba7b-c8d062a75c7e", "value": "6144:/RP+tvAbB0TcAcig3SuEE/UPTYkkK795PuBSciRzWpIIjxmV:/gdAbPfh3SW/Uc5K73PuBMRYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624265094, "uuid": "a6a7c8d9-1767-4e81-b458-39fb5bf40b8c", "value": 1513984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624265094, "uuid": "48e50ac9-6665-41c7-ad4d-f9e4dba56c88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624265094, "uuid": "4a243fe2-932c-44a4-a02a-700e6544a102", "value": "a9cec405267f2d20857975c662091f10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9650a4df-d2c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624304881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624304881, "uuid": "4d06bcb2-ea0b-49dc-8034-055a28898589", "comment": "Malware payload (Quakbot)", "value": "a4d36466a9c1e7a7296c41fbff701c05", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624304881, "uuid": "93a183e3-7c32-4473-8271-ade27205bbf5", "comment": "Malware payload (Quakbot)", "value": "bd09c02a8064de5f44d409eae767cfaa743c154edf967986f87ffb703467cf62", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624304881, "uuid": "edb7d7ad-50da-41ee-8086-32f7c897214e", "comment": "Malware payload (Quakbot)", "value": "651f3e7b5e3c03033da9e942ffc67fde1c1813bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624304881, "uuid": "4434e820-167b-4d23-9062-2012cd1c8abc", "comment": "Malware payload (Quakbot)", "value": "d9efa906b5c7d0f9e1ec9d5d948741985428484700b3d3dbe56a12a7246f3efe4cd31af318e0ad4c6bfd4d60129a8d85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624304881, "uuid": "1b71dc57-3fea-4a70-9da5-e3221405058b", "value": "6BF4CF217682E471C2F766360F64E5E10B5C74241B745ACF32E83B7F1FA84E3962972A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624304881, "uuid": "9d347100-86c0-4257-b71e-9a26563d6e9d", "value": "d67f9ece491ca951fccd592592c16db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624304881, "uuid": "79ac3745-6b3c-4e95-b171-80e3e085a68a", "value": "12288:azKiZ3YOU0q2rbomA+57bEKvVxsQr4sp7+9c3YpOkOgJykAUT0D6m3n7UWZHMINg:aNUG57bEKvoQ7+9PpO+JyVPXACxpkzab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624304881, "uuid": "5bad42a4-c8c5-4cbc-963e-72cf89095316", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624304881, "uuid": "d567462d-9b8d-45f5-8293-8176f41e9c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624304881, "uuid": "189ec63b-f0d2-45dc-88b4-91c781495e46", "value": "a4d36466a9c1e7a7296c41fbff701c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7980c1-d28c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624278528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278528, "uuid": "e485d5fe-35e3-4e16-842c-590b7279c971", "comment": "Malware payload (AgentTesla)", "value": "a8135bc40e7ed54bb2f77697477df14b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278528, "uuid": "f20cba0b-d369-48df-8a6e-69d6ed4b3bce", "comment": "Malware payload (AgentTesla)", "value": "bdfc49b16e58d20957a098ccea47d73a9319637d9d7e2e48978498743cd9be02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278528, "uuid": "9c632014-02bb-4bfd-ac5f-4cd2c2867aa5", "comment": "Malware payload (AgentTesla)", "value": "8b249931adc883ba10696a7e1e8b48c8e3aea67f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278528, "uuid": "bb17e924-99c6-4d5b-a9ac-aaf47b8c8b52", "comment": "Malware payload (AgentTesla)", "value": "dd306666c90bd90670ec1f3f2d5555484790fcf8a9a62a904b4cc234a35556eba5b9dfd4988c6185659eac818913eb4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278528, "uuid": "c159fe9a-9ca9-434e-9893-e815a34fa0b3", "value": "E1F4CF7039EE610DF57B9F781AE436E29A7BBE637B07995D14D0234A5B23842CF80538", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278528, "uuid": "e55d08a2-7ec7-4bd4-8dd3-5393b3079017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278528, "uuid": "e64e8f5c-1520-444c-b0c0-dbacfcf70cd9", "value": "12288:+5nbgOVWFHmsGHPU5Hl6S1e9ktnHPcLtA8Cbi0UIuyPRPzl1/Y1l7NX9HhU:+5bdyHYHPU2S09ktmebIfARblu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278528, "uuid": "cfbf8267-e248-4674-bbea-701ef4a17244", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278528, "uuid": "0c4c4bb4-2e8e-410a-9c71-86c551ef48da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278528, "uuid": "37c2a5f5-694e-4e80-9b61-4dd9a2145a7e", "value": "Inquiry pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a796a5-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624298657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298657, "uuid": "eee9685d-ee3f-41e5-b953-57d585789c6a", "comment": "Malware payload", "value": "1276a0cea6b9f89e0c80e23234ef9356", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298657, "uuid": "803e0c51-5636-4445-b72b-35a59a831d3d", "comment": "Malware payload", "value": "be0d869455735643e585af5bf0189c4b21de569718863a84c48086cb69551d4d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298657, "uuid": "e32fad75-11f9-4143-857e-995d161369e5", "comment": "Malware payload", "value": "638d7b3301120171d87f46263d602b6287d4ba3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298657, "uuid": "c1db45d0-7522-4da5-b90e-9b3c497587be", "comment": "Malware payload", "value": "c42a55d25d482dd2968dcd6d1927ebe822a8950a7e4afe9ca2cff64e97aef2395b1d2675f490f962e9691419155c32e6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298657, "uuid": "a164a53d-1c43-4342-81d2-1b73ab415678", "value": "2742E785FD92D191C9CD13BABD1D89CE3303B3A5D2DA3292DE0D5F28B2CA58D0E65583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298657, "uuid": "b3edecd6-5f2b-44e1-8e08-25ef5a871b73", "value": "192:ClcTnOaDjV79bAT9SK0WIyDZA0LB9XYkTl89Vlscw8a+CT6uBOR0I:CMnLhb4FlDZAsB2Jh+8avT6uB9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298657, "uuid": "830bd7be-5b38-4bba-a47e-d0302ce72e0e", "value": 12420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298657, "uuid": "679fd8cb-d443-402f-8a14-e65fe471cd22", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298657, "uuid": "345c610f-99e3-4b64-9e0e-b951c4a13aa1", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2280e7-d231-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624239715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239715, "uuid": "f1914fb8-e5bb-4914-a4b7-d21b5e8a61a7", "comment": "Malware payload (Mirai)", "value": "38fe5ca04e392a87e28f739029d43ae9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239715, "uuid": "71e4d444-6cc6-4ba9-9c42-37dc707ba86e", "comment": "Malware payload (Mirai)", "value": "bea0bb3bee37f369f5e22bb9f87358bbc5e1b2046d569054829804a777966fa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239715, "uuid": "4c112094-3edc-4a44-b894-897ed8361e43", "comment": "Malware payload (Mirai)", "value": "916fd30c5ca2506448aa8d5f462db68378ceaa31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239715, "uuid": "2d719b98-d98e-4783-b0a1-1b64566dad20", "comment": "Malware payload (Mirai)", "value": "79e9e0d8cfab4c6838cf70655e6623a920f661246f914f81bee11f108132230df8783c5efced832fc53db1c53d01247f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239715, "uuid": "3fc7e3c3-17fe-493f-bacf-4b9022dccc8e", "value": "69D35B42A704DA77E21307F505E78B310632F97E1A5B8F0AE7286CF98A271C4B257B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239715, "uuid": "b6cbcf3c-fd57-475c-a77b-62340563a331", "value": "3072:IkB6hjDGgP9UvcfMS38J80KmUAResJbLgAlcmrjVwZRV6D/A41rz:IzeiW+Mp80pXReqX7jVwZRV6D/A41rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239715, "uuid": "4f12d32e-2ca1-4d34-b0f3-9413585ff679", "value": 131136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239715, "uuid": "fd7be84f-df66-4aa4-9a69-77ed506f960d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239715, "uuid": "dce43a34-6d83-4a6b-8006-d59aacaebc63", "value": "38fe5ca04e392a87e28f739029d43ae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602091b0-d2aa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624291476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291476, "uuid": "2ea2b405-0497-488a-88e4-12abb74975fb", "comment": "Malware payload", "value": "6c3ce51043f298bf63e6be39c1f7182d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291476, "uuid": "7368c09a-9e6a-4ca2-8167-7706b59841b7", "comment": "Malware payload", "value": "bf0643695d745eb4e18fd4e200eda41b76f751c4a472271db462da5e308ce960", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291476, "uuid": "21f3290d-47ce-436f-b523-9359ac8062ce", "comment": "Malware payload", "value": "19fe7532a4d77828e08433e985303f93f06e3c3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291476, "uuid": "fc2ac4f0-1527-4760-9540-3e3815dcdcac", "comment": "Malware payload", "value": "00dcdaa7c947fc33e307649237e89a5abe67544ddc9ebb0005c553c31af98164666a30482e7cb68ba21f00dc3e386097", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291476, "uuid": "38f67482-229b-4494-ac50-eb3ec38cf9b6", "value": "51D2E01DD8B78F26DB2246F6018B8E14AEFF8374ED196EE14A61278403BE00B6468748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291476, "uuid": "2526aea3-80eb-421a-abf3-ab810ef65aa7", "value": "768:win4W+m7jnflBAu/1ja/0tEkVeTp2HP3Xd/EcJd+srFGHl:EWTXdmu/5k063Y98cJHZGHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624291476, "uuid": "d79bc0fd-2ca4-41e6-8306-59f6c65c5726", "value": 28960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624291476, "uuid": "f658705e-860d-44ed-ba1c-a77b1ccb7c95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291476, "uuid": "f6b30e68-e23e-408d-9fa7-538552c37476", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bce17e-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258877, "uuid": "6af95f26-a650-4183-b847-8be70a6b14a0", "comment": "Malware payload (RedLineStealer)", "value": "ebc86d43d55d9677869ae2ccaa72a2fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258877, "uuid": "804487d7-5f79-4ac1-b331-fe0f86758087", "comment": "Malware payload (RedLineStealer)", "value": "bff2f9ecc672d7d008086e71219a2dcbee7aa042652558f92bb86d3d56246e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258877, "uuid": "14f6388d-3186-45fd-98d6-50a263956d02", "comment": "Malware payload (RedLineStealer)", "value": "80933a91af72ba7cbe4ae31f387db575227db49c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258877, "uuid": "ed83bc1e-cf9b-4a4a-bc6f-c5eb50708c82", "comment": "Malware payload (RedLineStealer)", "value": "81d4113c8e30e47c24c4b1dbad3821712322e66f9d85df9f734836001505ea3c5ecfb08903a074ce3deb5f7f027cbd03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258877, "uuid": "00dd466f-7278-4805-9d4c-3ea2227a09bd", "value": "0984BF11F7A0C035F2F762F45A7A93B8A53E7AA16B6450CF12D52ADE4A347E0AC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258877, "uuid": "b0893e19-03b9-43c1-b85c-41c9e508d6d3", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258877, "uuid": "4b840fa5-ffd5-4a87-8f89-ab4ff3aa6e6f", "value": "6144:zgz2tIBwkrO204t8OGhK8zcuoMa3OwEScdCG+YhAAAdOBFZrosesoKrif:y2twwkrOz4tcK8ouu3kScdEYh5TBQ9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258877, "uuid": "84262e26-9789-4397-9171-1dd4de88b4a3", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258877, "uuid": "9247dea5-2a06-41ca-bbb7-7c6050c579bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258877, "uuid": "988753cd-43ef-43ef-98d1-646b6ab1ad8a", "value": "ebc86d43d55d9677869ae2ccaa72a2fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618f4c3e-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624287183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287183, "uuid": "5f01ebee-d88f-4d33-8bbb-f211dc5ccd97", "comment": "Malware payload (Loki)", "value": "edf5351c9cb0af20f7a8ac5378e50afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287183, "uuid": "fbd19bdf-f616-4e84-8faf-d36dc7aa2e79", "comment": "Malware payload (Loki)", "value": "c0d0bb88f168055f81d335866bc16d4560348d6592714b8cf2e44355b1723942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287183, "uuid": "2f8e7328-9ec7-4f9d-bc62-2b909328aa39", "comment": "Malware payload (Loki)", "value": "373eaf82dd85ea8b090e4c857212320ae22b66a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287183, "uuid": "a74ab68f-79ac-4ee1-a8f9-04606473ec02", "comment": "Malware payload (Loki)", "value": "d819d7a03eb9aa055ca6b5d309d985929d7cdb6899f7b5b4281f899658f6bc67706f8f727b293a3304de367560b80450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287183, "uuid": "ae8671eb-3704-4d3a-8b09-f2e38f249856", "value": "3DE4CF303AD9A615F17BEF7555D07190ABFEB723A713C54D3DA002C60623E81DEA253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287183, "uuid": "bc563fc1-7357-4950-878a-67472448e616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287183, "uuid": "f86c021c-8fe9-4c61-8b30-b4215ab63ba3", "value": "12288:wE1WFHmsjBbOEeOKKFQyhbQY8ZFNiD2o3idO3mjWYTl:tSHdjeOfFQyhbQY8tin3mjWYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287183, "uuid": "a1701599-ab59-4c8b-bdab-9b941e227b5e", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287183, "uuid": "fd4e27a6-8fe8-4d87-bcf6-ae20dc772646", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287183, "uuid": "ab3c4799-0572-41e5-a76c-5271fdc64042", "value": "edf5351c9cb0af20f7a8ac5378e50afb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d9e20b-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303263, "uuid": "4fadf77c-53ca-426d-a944-d135943a6374", "comment": "Malware payload", "value": "09a1ff5bd3b42df8093a85f6b1861ed7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303263, "uuid": "2abe3fee-a88f-43db-a180-74eaf56c7f7b", "comment": "Malware payload", "value": "c0fe37f0bdc8d38ba9c63b34e610f047d655e66bce1b07094bf9f62d5fb07bcb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303263, "uuid": "d337d748-ec37-4ce1-8281-32a7537d9723", "comment": "Malware payload", "value": "650769c31905ab7e6658f7c57256087ba7bcc94e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303263, "uuid": "17d5d6a6-c720-4249-88e9-b6830fb62423", "comment": "Malware payload", "value": "a70a3f68f286947d4ae4498790c2e8a75b553bcdf778dbefa54dece33b057aa0c322bd3c4cc4ed48b6eb7717724be1f7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303263, "uuid": "2c5249c9-c716-49d2-9896-a9b813a873ea", "value": "D233C014F101DCA0DB2FBD7892F950B066AB16B4F390AC957894D54D4DF116E8B2B3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303263, "uuid": "fbb3324b-df84-4da8-b18f-738f99985d63", "value": "1536:/s0bKQIOf7SieU6ZDvxjxcpAr/USvhWNssHv:/VKWSiebvxju4/UchWNssHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303263, "uuid": "1c0ac43f-4970-46e4-9429-b8c0c55061e8", "value": 51418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303263, "uuid": "90e166e7-8322-47a0-9a3a-10cba0ca37ca", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303263, "uuid": "e5404750-a755-406f-bb7c-682bc42cc974", "value": "statistics 06.21.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b16e2f-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315247, "uuid": "6a9748e7-6b50-447d-bd60-73bef6800916", "comment": "Malware payload", "value": "02c0e2a639f591f93c75f9a698355354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315247, "uuid": "22170cc9-a94d-4a7f-8ec2-0d0a4b773572", "comment": "Malware payload", "value": "c19335daa94f85852468d5dad1fb9cf93bf121aee3eac8203180d88479965d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315247, "uuid": "6675f365-a031-47d6-a5c0-0ad61958c0b9", "comment": "Malware payload", "value": "a09cf1757fa3950d3993c16c77aa0c3c8bbd3a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315247, "uuid": "1fa0d50b-58ed-4f23-be42-163418478c55", "comment": "Malware payload", "value": "a89f003c1bc88e262c3c4e069d9f81baf40a2ca430142ce6d26e12f1d0779372c23209334b3733a98c93c5a245b90e76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315247, "uuid": "4283cc12-2414-4e49-a3bb-575f3eb70662", "value": "D764C14DCA8B417687FED3BC106DB97BC80A0A1DA9F736D537B29461D69070B1CEB209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315247, "uuid": "d5fc99e1-f7f3-4341-b4fb-d9e2258eff8c", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315247, "uuid": "4508e2c2-6cf3-44b6-835e-c0b66eb7f2f1", "value": "6144:t1YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:rYlNRmFJC8y9hrqGdVt5rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315247, "uuid": "f29d4a63-63d2-4064-b249-9d4bc30d8400", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315247, "uuid": "71ab0bff-5168-4e51-83df-5d68a7c9229c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315247, "uuid": "2cab0f9e-ae87-48f2-8b5c-8d2792423fde", "value": "Bf9hQ7OzM211i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427342b5-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284984, "uuid": "a122be4d-abdc-4dd6-821f-a59e7bef2449", "comment": "Malware payload (Gafgyt)", "value": "ea72a562b28d0a039ddd2bc5e876ad70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284984, "uuid": "fca49986-43d9-4098-b34a-e55cc5fb7491", "comment": "Malware payload (Gafgyt)", "value": "c3dde7185db9be8fda943e1eb926112fb961c70fc081839285717896fa47e0a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284984, "uuid": "ba56f10d-d7fa-4dc0-8ed8-4d3d94b65fc3", "comment": "Malware payload (Gafgyt)", "value": "58f689769227cc7d2ad021d1500cbfcac740e1f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284984, "uuid": "d3a0bd4c-df2b-451a-93a9-c8de85aa2789", "comment": "Malware payload (Gafgyt)", "value": "15813edc0f2db8904a4bfcdbbd083d22f8259cbf8594dc2ce470e01e5331ab90adec5933f20d24664114834792d78faa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284984, "uuid": "e20d2d4f-93e8-48fa-a3cf-ac9f483afd20", "value": "23C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284984, "uuid": "e984758c-9063-4eae-a22f-9b059211a872", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeWEdWfRZrmW+IFj:Ted0W0MZQHYd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284984, "uuid": "b79e7de8-1a80-4fde-b94d-ead2a9717ef3", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284984, "uuid": "ccc52790-b2db-4b2e-9de0-64d866fb41af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284984, "uuid": "9a335a0f-2ba7-4468-93d5-ec8f8b49883c", "value": "ea72a562b28d0a039ddd2bc5e876ad70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c21bce-d2ec-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624319834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319834, "uuid": "73e952df-756b-4e51-982c-3dfcacc2541f", "comment": "Malware payload (Mirai)", "value": "d1a7e157d87fb36f4c47f4dc96817711", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319834, "uuid": "c68f09d5-0215-4b4b-b428-cc474e43fcd1", "comment": "Malware payload (Mirai)", "value": "c4bf262ef8743b0a2f6640697c3fd3f80417795e14ccb91b19663646894718fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319834, "uuid": "947ba3f7-cfe6-4c26-87d2-a862e0b339f4", "comment": "Malware payload (Mirai)", "value": "0373d820248531e076bd7f73e5b2337d5f91d81e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624319834, "uuid": "dd5a68e7-bdfc-4956-bd50-5d9f432451b9", "comment": "Malware payload (Mirai)", "value": "04c8944086ce53dd9fe8e60091c938a7e2c15b1386e17be8e1e6aa074ce894ba31403e526b139a5b383200c11f49eea0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319834, "uuid": "a7f64406-20a5-430b-9d15-d783fdd33741", "value": "96E2E1B4A725A860F5700C3BCDBF96EB19421E3CD1FA3B1618084795D22B3C67935ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319834, "uuid": "f5de0718-f7b1-4fed-914d-8659726a6e01", "value": "768:kL6y1JlHo+YXU1IxDqxNvkQC/oKfd2B9x16jNbJx6ms3Uozw:8h5uhDqvvkX/oKsduALzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624319834, "uuid": "f4cd783e-aa2f-4b25-a2b3-c334e3abd85d", "value": 32016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624319834, "uuid": "ca380fa8-4739-4e91-98e2-3f6652846e1d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624319834, "uuid": "51500161-6bb3-4d1b-91c8-4802e6bb30ef", "value": "d1a7e157d87fb36f4c47f4dc96817711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc3992a-d2de-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624313831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624313831, "uuid": "ed8b1b6b-2b3f-4fd6-8e14-ae7a4313f71d", "comment": "Malware payload", "value": "816c05b4cb72b0362eacbd3833815e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624313831, "uuid": "f416718f-dec8-4d99-9df0-fbe07a597c80", "comment": "Malware payload", "value": "c4c0bee389392c0677fd977cac9eaa868448c42d8b90281872cdf5b804e0525c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624313831, "uuid": "9be0a89a-75b2-4827-bb27-e460ed01dbc8", "comment": "Malware payload", "value": "3edb2acbb7af730997f4dcae61a72eee3ca8610b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624313831, "uuid": "cec152b6-e53f-4f5e-81f8-ddac4c6b5ac0", "comment": "Malware payload", "value": "afa2f07fe4d5b20e560d0f7979bbd680cbd08315f32fafc09f40f648aa69d802fbb6ad66d48a7f782df6a4e9d3b61553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624313831, "uuid": "a92b07b6-0996-4951-ae01-61de27ea374c", "value": "1964C14DCA8B417687FED3BC106DB97BC80A0A1DA9F736D537B29461D69070B1CEB209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624313831, "uuid": "51e2f948-4908-4aae-b034-1b56a326491a", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624313831, "uuid": "1baee8b2-d20d-4d0d-919d-f1ece02e57d6", "value": "6144:91YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:bYlNRmFJC8y9hrqGdVt5rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624313831, "uuid": "427754b4-a84e-405d-b195-e1e466c3572d", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624313831, "uuid": "f5e60258-76d4-4747-b64d-22c072b33bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624313831, "uuid": "effc0128-37c8-456d-a88b-ebb02a2491f0", "value": "YipWkEXmPSC0ErJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3848850-d2ba-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624298488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298488, "uuid": "77cf67c8-94c4-42f4-87e8-9d1b164f9b44", "comment": "Malware payload", "value": "34b4ecd3d504f776de8ff93dd795f1d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298488, "uuid": "c53462f6-574f-457f-800b-a791800c832c", "comment": "Malware payload", "value": "c5142e1d6eec472752c7b9f8c2c67672c7c207e8dabe29c177213714b0a52e0a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298488, "uuid": "b6006b3c-a4d8-4f94-bfc1-8c0ed3ef7b7b", "comment": "Malware payload", "value": "dccb2df960c43fa312d42fe561fe0b79c8b97aae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298488, "uuid": "6f524799-471f-43ca-8be5-242e9ef156ce", "comment": "Malware payload", "value": "dcbfa8b3b85ec06c3510b11f1f0d5c6b4a936f7ae665dbe8904dcca59144a82d01fcfb69514f631f51534ae5e6b19987", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298488, "uuid": "23840f06-b700-449e-ae52-ba2683e7fce3", "value": "3864029BEB62AC5FFD578BB015570B1627F8D5D9D3C69580B36888443CBE345E3602C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298488, "uuid": "a96b80b9-41f7-4ed1-ade4-745d2c324029", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coiOQ33Q:7O/QJHZweEL/NOjCHm7FZZncdOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298488, "uuid": "b987d95f-6d1b-4136-969c-cd6ae2e65d28", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298488, "uuid": "2640a046-7839-4732-89e3-7b0b53ab02cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298488, "uuid": "74cc5e00-5c0c-43fc-9b4f-30beb74927ee", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0960f3c8-d2bd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624299491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299491, "uuid": "18c2324d-cef7-4225-9b94-8dc1090c10b2", "comment": "Malware payload (Mirai)", "value": "2c6745b06afc57231e4b91f48aa7e1b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299491, "uuid": "0087a8ab-7b30-483d-bd39-2f1f60e7412f", "comment": "Malware payload (Mirai)", "value": "c5541f5a519dcde403c24e81775dc519682e026e9eaf409ba59b75a75c58fea9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299491, "uuid": "7c192725-e0f7-4278-b600-ff15e8a9e29a", "comment": "Malware payload (Mirai)", "value": "950a664937913cd0a1b98185a15da54aa6db5d69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299491, "uuid": "f208c707-6635-4e81-a0df-098648b2a467", "comment": "Malware payload (Mirai)", "value": "d02e7ebad1f2b76d7b1b918420d189126ce8d568475f52489079ad9a56b6480ac318208e11001f53e24f0445f4bc7ebe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299491, "uuid": "a2e564a3-6193-465c-acc9-152e848c2a8e", "value": "D2B2F1C9D6FB17C3C2A1C332E0BC565DD2721AC10746490A5109729EA39760E47FB3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299491, "uuid": "56b4972c-fc0e-4551-b604-dbd2d4b3062f", "value": "384:MvDKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLe:i/QOC0Yhn6ROHWFlAcwNEFCnNBxcmycP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624299491, "uuid": "e11359cd-fc6b-4c95-bac0-a545390695f2", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624299491, "uuid": "ccf984f1-bc38-4ce0-89ff-c4803880402d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299491, "uuid": "61bc8c9e-a184-4a4a-8377-441439bf844d", "value": "2c6745b06afc57231e4b91f48aa7e1b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c444e5-d28e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624279678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279678, "uuid": "d82bdf89-61f3-41c2-9b45-7c822e5b90b0", "comment": "Malware payload (Mirai)", "value": "56d6f5ff746fdb4b68adb55b2cf9e17a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279678, "uuid": "bee4c2db-7c1a-48f1-ba33-ad2058167deb", "comment": "Malware payload (Mirai)", "value": "c66f1af24da5195bdaddf2e27386378fe16d4c33b3aa284b3037261e46ce2627", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279678, "uuid": "3be861ec-1b7b-49f7-b2fa-f3801d365c45", "comment": "Malware payload (Mirai)", "value": "67d31b7404c3db94db45e39dce20d6bd8247a9b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624279678, "uuid": "71b5f8d6-d926-4223-bbfc-8be8637e9184", "comment": "Malware payload (Mirai)", "value": "10c07d05414a9f2e4dede964d3d6ddbff559f5b2bfb0f942857da6d2ed213e83d6eea7c3d69edbb1412a0f238883a9ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279678, "uuid": "ec9197f2-11f1-409e-a88e-76b4f7d1e7e6", "value": "73A31A5AFB808F07C0D22775BADF42513323DB55E7DB23065628ABF43F867AA4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279678, "uuid": "7359be52-0ac1-43ea-8a2d-a93ac83ce244", "value": "1536:jAnA8J5A0E/UdhO0kWs4alfEiVTWfBGeiqT3AJCwPwzzw/9bK0vmsifgs:QJ+0E/UdhO0kWkbTUKqT3jwoM/9yIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624279678, "uuid": "d095bfd1-360b-486e-a6b2-b13c7f557929", "value": 98353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624279678, "uuid": "11f20299-b80f-415f-9966-0cd7e925982c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624279678, "uuid": "adb86478-a641-45ac-8ee9-a1ef0fa3abbd", "value": "56d6f5ff746fdb4b68adb55b2cf9e17a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea74235-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624258885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258885, "uuid": "4558c77e-5ccc-4c58-aad7-18d23eb16546", "comment": "Malware payload (AgentTesla)", "value": "7eaf0cdd0312ae7b9e671fe14f424d48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258885, "uuid": "70556a35-50b2-465f-a6dd-8d9b9df21c47", "comment": "Malware payload (AgentTesla)", "value": "c771be7912e20d4522cdcfed63feac0e59a91dc053ff96faf862be6a8f8dfa1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258885, "uuid": "a06fb061-4c0c-450a-8af5-3c32f48daf45", "comment": "Malware payload (AgentTesla)", "value": "eabd9d6766013b89869747335b6b2171edba4b2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258885, "uuid": "48836058-c15f-4679-acb0-bb91a6f5a1f9", "comment": "Malware payload (AgentTesla)", "value": "745a3db234760faba9d2e47eabef9dd3071402d1ed7a2fe9e18bd613e8666cdf1874d2a928d0de63a3ca5ade5e0369df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258885, "uuid": "9d712ee8-f402-4d7b-bf44-4ad724a73bea", "value": "12F4B06039EE620DE577AF7819E436F2967F7E677B07985C24E4234A8723902CF40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258885, "uuid": "cb77d645-3578-4450-a9cc-939b40a4eec1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258885, "uuid": "23d9d644-89c0-407f-99c4-8a114d3d9518", "value": "12288:dxsneWFHmsTDwkQTyNgBSLkMB6RA8TUdvI1FxSKv1JWXHhU:dS9HttQTyNgBEkMB58+wB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258885, "uuid": "4c280a5c-4604-4d60-8da4-05e237832a9c", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258885, "uuid": "761bf28e-0fae-41b0-8fc4-5bfc144585a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258885, "uuid": "319a083c-0492-4e3b-bda5-a22c267f027d", "value": "7eaf0cdd0312ae7b9e671fe14f424d48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974d9b74-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624259356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259356, "uuid": "9286042c-c860-4ec7-bb11-df6250b754d5", "comment": "Malware payload (Loki)", "value": "f181208fcc49c35d680dbd84b8b16685", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259356, "uuid": "98a7db41-3594-42cc-a275-c9d26a96f1c4", "comment": "Malware payload (Loki)", "value": "c7b3359bd20765b46a6482aa8b54635f722c783b635344923dc077446b7b41aa", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259356, "uuid": "a94193b6-6d9a-436b-8291-9baac840d722", "comment": "Malware payload (Loki)", "value": "f58c9ca172a0de269d27abddfd3161b4f29fc88f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259356, "uuid": "f5ab3252-e55d-4b60-9ab3-a9840949bbb1", "comment": "Malware payload (Loki)", "value": "3c2afa032b59799a2a64e46f4271cfdebeb1f63c1585943eefedc35cca19db1610f31c38f6d90dd73254a537c6959fcb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259356, "uuid": "c29698dd-a276-4ac8-aa29-317cf3864049", "value": "2645121A7C04CEB6EC1A39F7C192E0246D458F28369EE00DDB75FE6A50365E3094F57A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259356, "uuid": "a9952577-933b-4449-a8c8-d17e84e0d231", "value": "24576:2BXnzH3zyAa6QjP4vZiovktcGZYPYMbTb5qrzk5:2tzH+Aa6Qz4ioA7yYWb5qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259356, "uuid": "98c98bae-5426-4e0d-b046-6ade56557e70", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259356, "uuid": "bc28de94-9633-4703-8fda-1ac5518b20c9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259356, "uuid": "daf0a8b3-cf75-400d-bf72-c97268967693", "value": "Spare part list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d901349-d28d-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1624278936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278936, "uuid": "00d3c546-e695-4d5c-b31d-b12e0ba5a23a", "comment": "Malware payload (BazaLoader)", "value": "a468360f0f1955c341486915e522e4c0", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278936, "uuid": "5113a1bd-335a-4ce4-b435-5d9e3adf27c6", "comment": "Malware payload (BazaLoader)", "value": "c8284374a3dbee51211289304b73bef0c6c3d00cd1fe3585b5fb8ca384c5333e", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278936, "uuid": "657d46c4-a5d8-4a8b-a9f2-235a80092bd1", "comment": "Malware payload (BazaLoader)", "value": "8206b8b5210413cfe45b4adcfc55e16635bc9384", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278936, "uuid": "d8c66a18-194c-42b1-9c72-e9faed1edebe", "comment": "Malware payload (BazaLoader)", "value": "5196e61ec6d6b7b4f6b029cb14b2a3c475fdd93bc482f5ac71645203998c160c2da1bd50902b1cfab19b7276ce61adeb", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278936, "uuid": "af676c8a-4d7a-43b7-97b9-2bb2803994ff", "value": "4ED3125AEFB22B19CF3D0875A016ABC4C5BD6F29CF8B8A50171EC1DC33A4AB71057680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278936, "uuid": "309f94fd-1e92-4969-913d-ddb70dc7a6f4", "value": "6859c1fbd5011b39e2b3c5ccd6eda491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278936, "uuid": "a8d74d1c-ea3c-413f-b2e5-5c1e5008cc3c", "value": "3072:4RaFivaICm87aDj3eTUGaSea1AIW2rgqE1BDa:4Ra8ibb4eUpha1AIW2Ev1Ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278936, "uuid": "1ef9f46d-2492-41e3-a532-d6fbccda9cbd", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278936, "uuid": "e7a689e4-be71-4773-842f-487115db3fee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278936, "uuid": "233ff0cb-15ab-45cf-a92a-21a31547dd08", "value": "c8284374a3dbee51211289304b73bef0c6c3d00cd1fe3585b5fb8ca384c5333e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1da118-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624285246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285246, "uuid": "5c1b9bb3-b169-4063-b521-4b5e9a713d74", "comment": "Malware payload", "value": "0cbe694396cd8651a8e6883aabbdd511", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285246, "uuid": "5473f7dd-d143-4d28-b0eb-5196ae8906d7", "comment": "Malware payload", "value": "c87a5c25f1f60a9938c09d083d1d64a7856d5377a146c802b7882ba94f996e49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285246, "uuid": "bc7a1bf4-4b3c-4806-9a67-475211222a2b", "comment": "Malware payload", "value": "a0691dff3eee26ffe6233e71e345b586386f60c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285246, "uuid": "335410d2-d47e-420f-b92a-4f066737b45f", "comment": "Malware payload", "value": "2bca4ff22add2cd59b17e90f7606d6dcfa45137318a1c0471632809def271532284a03342b3b48b8272379d9c337b821", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285246, "uuid": "06cc653d-784c-41eb-9751-6c88272c0709", "value": "8F03E12EC0E97CD9CEFD88BF60AD1324A502A9C06289AB1DD315C95CF89DD07380E47D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285246, "uuid": "3b5a6776-33db-4397-86f5-297a7a0e9d39", "value": "768:Wdi2ytDSryVk3hmoFZifxOo63ztElpfB3ImSc/152Lv0DBDWRhQ:gi2guyQhXifxMztElb4m5N4b0DBIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285246, "uuid": "7bfa00ab-c447-464e-8471-2746a3584cf9", "value": 38036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285246, "uuid": "4f7b24fd-952d-4956-aee4-c2c6f6736629", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285246, "uuid": "9d6fca67-ae78-4aea-b9a3-6213b27a16d5", "value": "0cbe694396cd8651a8e6883aabbdd511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d78618-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315324, "uuid": "1a21cc7d-27f6-4299-b99e-32ced330cfb4", "comment": "Malware payload", "value": "83033e134c3a1808a32848a9adab042e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315324, "uuid": "baa42f82-24bc-4fad-ba45-3a1f01e495eb", "comment": "Malware payload", "value": "c87ca8e27e058e4cdbb5d5de6bf2c3be01791f2cc3ec1b4452d867bf2f73cd17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315324, "uuid": "85eac879-5533-4b60-8008-5904d4122dbf", "comment": "Malware payload", "value": "1d2d32031c0e154157bca43e533e60a78de79d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315324, "uuid": "9f32f57f-3240-4d6c-980c-1b0bbf7ebd09", "comment": "Malware payload", "value": "80177fd7ca3a1490705ae693a3bc422d1178503ce398af225be12f4d87e876e9a3659e11d162396d0ef6d2ff61725b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315324, "uuid": "e47c9c81-af35-4b36-a16b-f1292202d686", "value": "5164C30AEA4B4176C7FDD3BC506DB53BC85A0E09A9F337C537B29061D69061B6CEB206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315324, "uuid": "80eb6946-8a1a-42f0-b877-6f4b1b670bcb", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315324, "uuid": "f2caf7ba-e666-48ad-a37f-b53aa9e8586e", "value": "6144:j1cQ7Z6QNqj1aO5Fm75Aeu9J5wjDcROFXnz4jtm7rNLt:BcQ7tN6aO3m75/u9wHCsXz4pm7rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315324, "uuid": "b3299c67-8eed-4fbf-875c-3cf4e2ac1d82", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315324, "uuid": "85b0ae6f-87e4-4a4e-94e1-6905a57e8bc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315324, "uuid": "6b65a428-de59-4d25-852b-5d1274d70eb1", "value": "CZ1jiJZI1L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0357e60-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624259371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259371, "uuid": "78977e1b-206d-4899-a467-b42f51300b9c", "comment": "Malware payload (Formbook)", "value": "d2f5d0df37764fcadae9fcd82aa9e2f1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259371, "uuid": "8e241b10-f8f4-45af-91ec-1a095e44657d", "comment": "Malware payload (Formbook)", "value": "ca418565495916289ebe5b5b11cc00eafa1e0c7dd0296d90208d524a1f5148f0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259371, "uuid": "da4a89a4-2c1c-4f10-884c-6b8d7421d56e", "comment": "Malware payload (Formbook)", "value": "e74c5c02fcd3667d853427bec813ada17c5d066d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259371, "uuid": "dd796c62-f99b-46a0-a8af-758787b52670", "comment": "Malware payload (Formbook)", "value": "4e340bae5045e03f3a5106d89f8a5dbe831658f8911d22b53038f91ab4b1da24b6880a9725c8aa5e762d56d1d6b9fe88", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259371, "uuid": "48d4beb0-3110-456e-95b5-1fca32d37513", "value": "837533289F9E5F4AD66A22344CF7D138227C9C9537D6ED12ADBD738520353B882A7334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259371, "uuid": "8df8952f-2951-47d0-92a2-5ac979c8ba59", "value": "49152:6p0VSjyVkUHGODj9IT2b5jPUf+O3QYlkLbjrZ:6j+kUHro65jPkl6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259371, "uuid": "36913bfb-dc2c-4611-aab6-48e83e9a4793", "value": 1614848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259371, "uuid": "367144a0-e41c-4acf-873d-bc6e14dfb047", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259371, "uuid": "d1386cad-3889-4975-88ef-c2502b5ec2c6", "value": "Purchase Order No. 7406595 .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b73220-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624298705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298705, "uuid": "08f25eed-2cc0-47e8-bdb9-f9da18428c82", "comment": "Malware payload (ArkeiStealer)", "value": "689cbd5a0af05279db0607a0090998b2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298705, "uuid": "144d7f5a-13ed-48ae-a9ab-09cc035b97db", "comment": "Malware payload (ArkeiStealer)", "value": "cab3e6e2c9a366a7e2276c6f224c8788d3ae7c03d217ac01bd43b1d7cc1b3758", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298705, "uuid": "6e586a23-0bed-4b70-869a-63f0ac136584", "comment": "Malware payload (ArkeiStealer)", "value": "b5d126d4c09ed7c421ad21c095f5922cf5264561", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298705, "uuid": "6764a53a-9c69-4484-9ba9-d6a3e9421245", "comment": "Malware payload (ArkeiStealer)", "value": "cb7d2a8b785cfec09c74f9781764f11db6bdb94c773f81123eae7eaeb4ca0c22354bf0c7538be6efaa7d48199e60e53f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298705, "uuid": "a3eb0d25-d20e-4e42-8d9b-6360240dcd16", "value": "94E4F100BB92C035FAFB51F86ABA9378693D7A716B6450CF12D516EE1A747E0AC31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298705, "uuid": "061acda3-e3b5-4485-830b-581c5ab3dcaa", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298705, "uuid": "28335836-2410-4910-9489-8bb19d66c2c3", "value": "12288:3+IbacGvs5Q+c/vCYRoEBrTWkkXzhZC88ZketGtqas7Nwl:3UcGvs0eEBrTpuhZNE4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298705, "uuid": "3c44871b-b179-445b-89e4-79e7e93d4492", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298705, "uuid": "e2148279-88d3-41ac-b6b0-b555cee4856b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298705, "uuid": "0f4d10d4-05fe-4630-9ce1-e3d230104491", "value": "689cbd5a0af05279db0607a0090998b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6def7b47-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624258857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258857, "uuid": "5f3704e5-6f6e-40e9-a445-fe38ae8e1f28", "comment": "Malware payload (AgentTesla)", "value": "858695dca1d5a15bdb0e4a164b7bd7ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258857, "uuid": "20e09723-c8ce-41a7-b6c5-d79df8696986", "comment": "Malware payload (AgentTesla)", "value": "cac3ab8433e775a539ed661fb2d9caf7799213007b9f8bc01080557c452ccc41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258857, "uuid": "8a27ec0e-6142-4a7b-a5b8-a04aeec47625", "comment": "Malware payload (AgentTesla)", "value": "0b5804b6cf1ffe98003414ef4144e2859721902b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258857, "uuid": "8a6d0121-5b71-4538-bd13-a99c0e7778e0", "comment": "Malware payload (AgentTesla)", "value": "f7ea5df277bee19ca3f14275c3161aea00ad173b270b19a346f36fc7994536bafb043106b1a39d1f1e379160637b0ccd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258857, "uuid": "d545bea9-1e14-4726-a2cb-646f6b54a458", "value": "F13528AD325072DFC867CC76CA681C68EB90787B930BD243905335E99A6D99BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258857, "uuid": "0fd44219-d78d-4b79-8827-7873617aa2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258857, "uuid": "0cc2e3bc-b7dd-46a6-84fc-d93218c8745d", "value": "24576:LngmivJ9gzkwUZUVOjZqepMMtej3H3iiN0DABL:LnGvykwUWdYBtej4DA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258857, "uuid": "78240df0-081e-472c-91bd-dd0a98e0f1cb", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258857, "uuid": "9f640d25-d3eb-42fc-9331-960a30208fe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258857, "uuid": "01906750-9907-493d-afca-c94310865022", "value": "858695dca1d5a15bdb0e4a164b7bd7ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2533a633-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1624298678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298678, "uuid": "bacee490-0ea9-478e-94fa-3b2b8ea56eec", "comment": "Malware payload (DanaBot)", "value": "3aed53920b7ade1d7393ef64d51e188c", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298678, "uuid": "f769454f-10b4-44e2-bf43-45f872b2d819", "comment": "Malware payload (DanaBot)", "value": "cc4f9284c5985be7c61d8ec207f920574382e57acac0d8e942e6ad859341cb2c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298678, "uuid": "934703ad-bd70-4351-ac1d-fdf75f198b7f", "comment": "Malware payload (DanaBot)", "value": "62c87652da6c3642e748fe5a2d048abf40661e65", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298678, "uuid": "5bfb98c9-1cbb-4cc2-a44e-74c1ccfe9275", "comment": "Malware payload (DanaBot)", "value": "0c596925a5ca9cba9bef9c1314bf6eeddb8aed4bed10d63eb4c671a5024574c9fe268dd6e747b7dd3ff8efc6aaa9c98b", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298678, "uuid": "462a79ba-8cdc-4742-bf0e-850d7881d4c0", "value": "4D450200B2A0C031E3FB62F859B693686B3A3BA15F7254CF52E916ED56347E4AD31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298678, "uuid": "553449cd-530f-467c-b5a1-9a724c46b53b", "value": "f24ed3cba0284e946897971a6b672b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298678, "uuid": "7e8b7183-b44a-4842-b254-a0c318b4600b", "value": "24576:jgnaAY9fX4sgkBvdJStV7FSdxubiIjZO4uinLu+0NIhBqhIVy/r2:BfXrgG8HFO4DLu+UITqcyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298678, "uuid": "b4deecf9-95b3-41d0-a505-0edb27fa2629", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298678, "uuid": "fe623c24-11df-474a-ac66-10e4de56ad50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298678, "uuid": "0938fda0-492a-430f-ab0a-3962bb742ab4", "value": "3aed53920b7ade1d7393ef64d51e188c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78729fb3-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303113, "uuid": "e633f091-2e3d-4cc0-b82f-c140282b0446", "comment": "Malware payload", "value": "778c7f21764d2fc338a5abfa2becfb35", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303113, "uuid": "00567641-42ad-4871-99f0-9c1247a9f03a", "comment": "Malware payload", "value": "cc70447b7be5068a55ad34baa92ebd524a00e0a4a210b69fa16d4bf84f48e239", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303113, "uuid": "41dc65d1-12fd-493a-a8fc-7fb96b6b3d15", "comment": "Malware payload", "value": "39dfa04561018e6dc4590bb6530ca2b2d5351183", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303113, "uuid": "ea6ce1c6-1355-478f-8a6b-345215d8e886", "comment": "Malware payload", "value": "8448c2bef6d71dfe64a288de1ed0b29ab0f5dd2db3cc5c7fcc929a178e1019e0393d6cfdd4c9b3cec9b9cf308721a678", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303113, "uuid": "43ada8df-bb1a-4bc3-afc2-91051b83a828", "value": "7B33D008F112DCA0EE1FED79A1F850B07AAB16B0F3909DC66C44A55D5DF305D8B2B6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303113, "uuid": "96af5acd-7c54-4cdf-8c76-8622015908f2", "value": "1536:/oH78QIOf7SieU6ZDvxjxcpAr/USvhW7Of:/oH78WSiebvxju4/UchW7Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303113, "uuid": "9992fe58-50f9-4689-bdcb-7e0aa110b38d", "value": 51644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303113, "uuid": "2bd27fae-c36d-4c21-b84d-300f6f81740c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303113, "uuid": "ed0ec236-6abb-48cb-9910-6a80cffcb451", "value": "certificate.06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f133bd71-d2da-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624312335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624312335, "uuid": "8ef67fde-e8da-48d2-bdd7-b1cf27017d2d", "comment": "Malware payload (CobaltStrike)", "value": "3b91dddf370e9912ded58f2a914a0c78", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624312335, "uuid": "16ed5c95-c5c0-4bbc-acbe-7de69db72fda", "comment": "Malware payload (CobaltStrike)", "value": "cc9a713b0db799bb4be1d74f9ef2d043985218e94d5004e5c42a4996dfb33131", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624312335, "uuid": "c019b3a2-d8ef-4834-bb40-9066339bea95", "comment": "Malware payload (CobaltStrike)", "value": "a22e42c5845fc79cee80dc490cc9c33a1de9ec7c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624312335, "uuid": "0f687e44-136b-4859-a038-127b2ad59ca3", "comment": "Malware payload (CobaltStrike)", "value": "f3788992ee0c4e539844b02ba50e32f86071d7e4e25e78dd716013d533d524510272a24331f8fd09dab8e0d5cd838f09", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624312335, "uuid": "47bbed60-07bd-43c5-a511-19ff9e0d8b0f", "value": "E664C30AEA4B4176C7FDD3BC506DB53BC85A0E09A9F337C537B29061D69061B6CEB206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624312335, "uuid": "b66f0dd5-03a4-4644-b58e-04b657d25a3b", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624312335, "uuid": "4d5917ff-39a0-4330-bedd-da47e9e19280", "value": "6144:k1cQ7Z6QNqj1aO5Fm75Aeu9J5wjDcROFXnz4jtm7rNLt:acQ7tN6aO3m75/u9wHCsXz4pm7rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624312335, "uuid": "e14efa6c-e6a0-453a-8882-c7ab32d13082", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624312335, "uuid": "0377e249-6a4b-4eea-ae30-d9cd1a8edf5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624312335, "uuid": "c9712fb1-2c38-40e6-ab23-7ee51dcc21ed", "value": "XeaqmO4btwUr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5741bacc-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315083, "uuid": "ab91c547-440a-4c9f-9bee-ee714088ba17", "comment": "Malware payload", "value": "8f20c8255e0f7a3437eee27525cc1888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315083, "uuid": "a558a393-c720-42e2-904e-fadabe76e15b", "comment": "Malware payload", "value": "cd4333533191a81dfd34340d44fa234ab01dffba24c47f6f733e05bef15c9eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315083, "uuid": "ccc814c3-7af7-4394-be14-e86399b548ac", "comment": "Malware payload", "value": "cc8c9b9541c1b40b6a3f7c1589d8c56fce892095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315083, "uuid": "94b2debc-bbd1-4408-8545-9291ee23dcb7", "comment": "Malware payload", "value": "a1963a2e54ea6d13ececcd626fa2db2ca0cd7b3c59f8b01b2009ffd07a54376c026a27bc04f6d4355945c1366afcd210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315083, "uuid": "f559db26-ac97-45cb-8fe8-ec6775a8dd5b", "value": "0364C30AEA4B4176C7FDD3BC506DB53BC85A0E09A9F337C537B29061D69061B6CEB206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315083, "uuid": "c8c9c066-70ab-45bf-a1cc-1fdac41fb301", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315083, "uuid": "ce37d04d-2be7-4e70-a429-102c045d1dcf", "value": "6144:y1cQ7Z6QNqj1aO5Fm75Aeu9J5wjDcROFXnz4jtm7rNLt:AcQ7tN6aO3m75/u9wHCsXz4pm7rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315083, "uuid": "c4081a95-fab7-4b92-8147-f35d69ca5954", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315083, "uuid": "bc191f51-6dfb-4509-b7f5-4a3b5af78849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315083, "uuid": "f55d7361-f49f-443b-965b-cffaf9463753", "value": "7HEpHpuL2mt2.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037c1bfc-d2d6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624310218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310218, "uuid": "9d54fb86-7a6e-448d-9c35-b8c371622c9d", "comment": "Malware payload", "value": "38a38c78818bcefc085f95cffd5ad55a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310218, "uuid": "8fb8f36d-049f-4f40-a17d-a61011b23716", "comment": "Malware payload", "value": "cd6bdb9822f4eaeb1efab9abe6aae3fd6d5d8bb8d33e0623497da6be51b201d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310218, "uuid": "c466b714-3f00-4eca-b68d-cc331a0a0fc9", "comment": "Malware payload", "value": "5f96567c4e605644b4eddd7b1a8b4c4197c5cd26", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310218, "uuid": "3a4ff957-237b-4f2f-bbc7-0be499576908", "comment": "Malware payload", "value": "c80b2d3f5faf33b235b2af413e0b6c03637737fab6eac9ecdb3c2f30170ceee3141269b3860ea2c2c9c300e7f8f6476c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310218, "uuid": "3b9ca972-26f6-4d74-9890-7d3fb95a944e", "value": "76129D68100B52FCF22196D182DDFB64447663EF65E88C7074C989C52F39EB2B1D06EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310218, "uuid": "b5dda4ea-2fc5-4976-be0f-43192f966456", "value": "48:Qec912iToWM+3qCocLF36+rbKowt4NdJWK0A7nc2KyzPugf:46g7Ls2RwEASf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624310218, "uuid": "b6dc73fd-8c83-4ba6-a2e7-a6d5bc03a539", "value": 9082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624310218, "uuid": "5701d3a6-6bc4-4ce6-8faa-846dddbc80a6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310218, "uuid": "6ea2890e-21c8-41c6-96ea-9b872596858d", "value": "Remittance.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cce4de1-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624298638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298638, "uuid": "de8d6dd3-7dbb-4d1c-92d1-f8e4319f634e", "comment": "Malware payload (CryptBot)", "value": "e0c4171c0bb82cf52647b0ccbfd6f3e3", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298638, "uuid": "cc27480b-9df3-4237-9cf9-0c9f9f6bb192", "comment": "Malware payload (CryptBot)", "value": "ce1bbaa73449eddc1391614810a6045ce48d90e4d89b0441b7371a709a31fc1c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298638, "uuid": "4a284851-b7e2-4cf8-bfa2-278e2cfc02a2", "comment": "Malware payload (CryptBot)", "value": "43e6f937cda75d77ea2d5e2f8517225cf24b9943", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298638, "uuid": "96ddd459-ff1f-45e7-9131-28cb2bdfed2a", "comment": "Malware payload (CryptBot)", "value": "9922efbc4ebeb18e53e4feee9331653dcc22f9b40c736a26da924a328b5b8026177a140790bed92abb1531c66f464487", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298638, "uuid": "b872665f-dd56-4149-a4f2-6e5e7526288b", "value": "9F05E100B691D035F2FB51F84965D368693D3EA16F2644CF22E92BEE16747E4AC32B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298638, "uuid": "bf3d5835-c3a1-4403-bba5-758b877ea868", "value": "f24ed3cba0284e946897971a6b672b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298638, "uuid": "d575ecbb-7a24-4723-97e3-9b92d4985a27", "value": "12288:T0X6061Odenw6nmR8ohDOTUG6mCPvxGa9Fm7Cq4iP+PKsFb7S0Lpx08xbGl:c60611GBEIJ13xGa9Fm2q3+PKAHxvZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298638, "uuid": "e44cbb7f-8d4d-49c4-8e65-1285f87af355", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298638, "uuid": "1fa24ca6-bd74-44c5-8e8d-936a7183b50f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298638, "uuid": "bbb1c265-351f-4450-bd2c-e9d8cdefb169", "value": "e0c4171c0bb82cf52647b0ccbfd6f3e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb7b685-d2b1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624294748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624294748, "uuid": "2bca7e29-565c-4cc0-97c1-86639a9655ed", "comment": "Malware payload (RedLineStealer)", "value": "9d9b6ff55b74de9f69b2cf4eca1c23ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624294748, "uuid": "72447d9b-ed8d-4e08-8fe4-198afcc4caae", "comment": "Malware payload (RedLineStealer)", "value": "ce91d4a07b20ceb88264098523530a899fa107d7a39393cdee35d3071ca8347d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624294748, "uuid": "17dbf8e7-1a00-48ff-8b91-8fd0b98b6f19", "comment": "Malware payload (RedLineStealer)", "value": "bd1ecd4d9d8cf6ff7ac5bf2691210bf3ec96f870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624294748, "uuid": "b6aa2b32-02e8-4db6-bae3-868a5b044b52", "comment": "Malware payload (RedLineStealer)", "value": "03c09286888edc205ad9f35a65d0e3fb08427a05cac1696eab20d1f7c1d1610da89b140062f7c8b3692e02844f0112e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624294748, "uuid": "6ab9667a-5831-46be-8853-79133001308e", "value": "CBA33C59B3AC8A15E7FE4974BB70112943F0E6CF6403EB8B8DC1A4DB1E66BC11A145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624294748, "uuid": "3b6a9cbd-35dd-4abe-96bd-b5fd5d1f5741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624294748, "uuid": "cf42bc20-b4c8-4d45-b4cc-320df384fd47", "value": "1536:6O/xzBxaCsZNfbfx2vRk0ymelxSmzow3Wb9VQ3cHx+yMCdl3mnmx82EyG6a9:6O/JBjsZNfN2vRktmyr+acHkyvdgRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624294748, "uuid": "fabd5874-c2ef-4b56-8726-460127ab7793", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624294748, "uuid": "8871a5cf-4592-4166-87ee-77e758dbbe63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624294748, "uuid": "eeacf73d-9432-4979-8aa8-c88d6e3786d9", "value": "Vape Beta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43010c0-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303240, "uuid": "4ab435a1-9e52-4df4-9818-2100c117b0af", "comment": "Malware payload", "value": "02aba3007f693a4b5dc9b485a8a42827", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303240, "uuid": "5ecb2a21-fdea-4ca8-b9f7-915329adb291", "comment": "Malware payload", "value": "cf6bc835020e94b637c6baffcf08e7ea20ddf1186b66ad9b2797e371e5c57ef9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303240, "uuid": "fff22c4b-1c84-4b90-892e-a2aa5774dea7", "comment": "Malware payload", "value": "b9b66c7ff411cb5badb7e75dcb28c6b9799440e8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303240, "uuid": "8e3a6088-d7a9-4af6-a83a-64e94f826460", "comment": "Malware payload", "value": "f42dab46fc7d6b747c7f1129cbe5e4a47721a639f037542b804d1e3ea6f720e0159c9ac9f840a065fd73d8d9e15155b7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303240, "uuid": "2b842a2e-4711-41e8-8f4b-2bfee33cfadd", "value": "C033D008F112DCA0EE1FED79A1F850B076AB16B0F3909DD26C84A54D5DF306D8B6B6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303240, "uuid": "99c5e75e-26a9-4c6b-953d-5fc76a3a6e36", "value": "1536:/oH78QIOf7SieU6ZDvxjxcpAr/USvhW7OV:/oH78WSiebvxju4/UchW7OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303240, "uuid": "e3990bdd-9a8b-4462-8697-3fbafb04a7a6", "value": 51643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303240, "uuid": "05111a98-6748-4094-828f-8dbd2c7d9f27", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303240, "uuid": "5c3cb068-02fc-4d7e-941d-836e26e2705e", "value": "report,06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c9e85a-d26a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624263944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624263944, "uuid": "41e81501-2a01-481d-9d3e-fa7c8902733b", "comment": "Malware payload (RedLineStealer)", "value": "29c87ad7e46276e80ec7281dbe59fe85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624263944, "uuid": "6915282f-b249-4198-b2de-f1995185e946", "comment": "Malware payload (RedLineStealer)", "value": "d053c7691eb796f931f408947987890795fd0a8066211ff3da5646ce17251d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624263944, "uuid": "e2a23406-a12f-4ee9-a63c-3b7398f2913b", "comment": "Malware payload (RedLineStealer)", "value": "b18c6b1fa3422fb68106e470587a7a870a2bee65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624263944, "uuid": "2de9ebcb-7a8c-44a3-9b6b-66d79368b28d", "comment": "Malware payload (RedLineStealer)", "value": "5d036e55d108c4f5aa951e60ba559af90df2374f6fca41637aa2a40097b52a1ee92cdbd0959c61bd85b6e75547d95531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624263944, "uuid": "ed4c7b01-8da7-4401-a8b6-ffc18826c121", "value": "6384AE11F6A0C035F2F766F4567693A8A93D7AA16B3050CF12D52AEE1A387E1EC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624263944, "uuid": "59376bf2-ca43-474f-b333-906dd6d13978", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624263944, "uuid": "0ce2385f-d968-49ca-99c3-93080f9eeec1", "value": "12288:RzXCAyouYNhFuFQlGk2JGJ9TTWWCd9lV:R+AyouxilOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624263944, "uuid": "071f1a52-25df-41ef-9697-a3a4dc0ce096", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624263944, "uuid": "b6214b09-2a4c-46c8-86fb-1aaa62863d6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624263944, "uuid": "dd9f0ea3-beca-46a6-8e69-2d385422f242", "value": "29c87ad7e46276e80ec7281dbe59fe85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3015c77-d23c-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1624244424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244424, "uuid": "983fd134-f318-4256-a0e2-a96f1e85711e", "comment": "Malware payload (DiamondFox)", "value": "a099353829ec693235e2475360aa0f0f", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244424, "uuid": "413b5d30-1f1b-4c68-b7a6-dff02b77754b", "comment": "Malware payload (DiamondFox)", "value": "d09cb69744c809f1e48fda7e9ab5623852a42fc6f2cf79547ecc3329871e84ca", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244424, "uuid": "906a9885-95bb-40c5-af36-18135b454312", "comment": "Malware payload (DiamondFox)", "value": "00ba1d2bf080d9ed3162b9797edcc3cb7d54959f", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244424, "uuid": "8e7a8df5-7513-4827-9390-03f21b7d6bad", "comment": "Malware payload (DiamondFox)", "value": "9b4d34ff4c496ce8454e0fecdaee042ff65671a2931786dbef740163cab89652256dd2703bd93e6e678e35a4380cbbb0", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244424, "uuid": "baf2c19d-e0e1-48fb-8a32-f9ed6d0e079e", "value": "07E53352A2F04D72DF8D59301C35E7B02DA9B43DC5AE71D29B80224953DE880B8AEF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244424, "uuid": "d8694647-5d34-4374-b99c-2116fcf6e432", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244424, "uuid": "ce4ddf50-f9b4-446a-8258-b13f31a0bd1d", "value": "98304:JLP8E8SVroA+SbGdYikwqDbrthzjBtzjtQzK:J9s06dQDlhzttNQzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624244424, "uuid": "f58f6251-5332-409a-af85-81930c01d773", "value": 3300058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624244424, "uuid": "e0417906-f803-48d2-9d7c-54852101c1a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244424, "uuid": "aeddc573-9536-4f4a-ae54-d8e8ac0969f1", "value": "a099353829ec693235e2475360aa0f0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f06e12-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624287275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287275, "uuid": "bef86fdb-8543-4627-bc38-5d58a10aec87", "comment": "Malware payload (NanoCore)", "value": "1cced9999ff0a6e2c7e02fd76298a42b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287275, "uuid": "1138ae7e-f4a4-4fc1-90a0-aaae65730a97", "comment": "Malware payload (NanoCore)", "value": "d09ef84a2d2a316985b6a88223daa967c7531733070a3590c16808f6069cf820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287275, "uuid": "20131f9a-eaba-403b-9823-1b626677211d", "comment": "Malware payload (NanoCore)", "value": "2a4d799829c537ce1cdc1d27bf7952599816f17d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287275, "uuid": "7e3dbd7c-4bc8-41a8-a6dd-f765a4f3ea07", "comment": "Malware payload (NanoCore)", "value": "98a08d961296bd13a5fae5c23f1017d5f12df889b60d80bf0f78bb6877fb2f44597db36a3028bf980e448855e539489c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287275, "uuid": "8eb0accb-e9c9-4b87-97e1-9ed14fe4a115", "value": "2565D1634ECF476FD26809B59731AC4782B24DAA2944B3123EC074BDD93B2EDD6AF501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287275, "uuid": "beded744-2653-480c-bd41-e97167c5c2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287275, "uuid": "9bc2b15c-206f-4f39-ae49-9def54b64369", "value": "24576:LipizrSmceaZWe2zxUo84gXjgSRe2l3hk+Yrr4XDscujMH+:Nceaoe0Uo858SY/VMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287275, "uuid": "5e6bc0bb-b79e-41f6-9bdd-f53fdd38afae", "value": 1409536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287275, "uuid": "9155a08d-7426-4dfe-b8a2-14a9f9c2d302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287275, "uuid": "78b3a13b-0fb0-4ec8-9d92-70eefab6351e", "value": "1cced9999ff0a6e2c7e02fd76298a42b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150f73ba-d280-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624273311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624273311, "uuid": "3f61e944-714f-4d4c-9c66-0ed745807380", "comment": "Malware payload (Loki)", "value": "4b5b7c63c36160c29b1940453907173f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624273311, "uuid": "9aa7a83b-a744-4373-ae30-6d3b6d15e89e", "comment": "Malware payload (Loki)", "value": "d2489ca180a16314fa8aad79b7bfff402c3f62f497a237786a5b4c9f770b380d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624273311, "uuid": "323809f9-a239-46c0-ae30-bf51c376d2f9", "comment": "Malware payload (Loki)", "value": "1abcb961aed511ca02c8eae2b45f8846447dd4f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624273311, "uuid": "14b16288-9cd5-4e32-adb6-5ded0c59f69c", "comment": "Malware payload (Loki)", "value": "1ac40acb43efc55f3392145983685ac6505e9ff329e1349958ecf469ce1be301d5aa61eaf2b7be5dceb2c1aa30de8078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624273311, "uuid": "dc7bb1e7-9446-46e5-a663-edfc61476e8a", "value": "A725BF320ECF422DE2754FB957B0BC4782B6ADAA2705A2163DC031ADC9375D9CDEE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624273311, "uuid": "9db0ad13-0992-41af-b21b-29016da22781", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624273311, "uuid": "c5a042d6-0cc1-420a-84cd-b03cc525df91", "value": "12288:azJWFHmsPSMPQipP5Lv4rCscVkXUBb9j8+8EcTEsI5sFniOVNRG6USNi:OOH8ipOrDVXyeJMh5ciO7RGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624273311, "uuid": "6854a4f0-353a-434d-8f24-6dea450b62aa", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624273311, "uuid": "1052199c-d2ad-4790-87e2-58126ded6060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624273311, "uuid": "2c26cded-b2f9-4783-8903-97039165625b", "value": "pdf.zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5c44d9-d239-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624243155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624243155, "uuid": "e8e71cfa-e289-4e0e-9295-f024957a9ecd", "comment": "Malware payload", "value": "d7b43ea86a96e3583359b0bea8fffc74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624243155, "uuid": "ad2be497-b99f-4aa8-865d-6709399ac869", "comment": "Malware payload", "value": "d24b2f6e96fa1b2bb20b19e3b70757887a3f4934d035fde4efdbdd5b9e845df9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624243155, "uuid": "9c981152-08dd-4796-bc1f-23540ab450bb", "comment": "Malware payload", "value": "2b94a54f6631507999f855e0b870fee9c583b168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624243155, "uuid": "22490dd5-6522-4503-9234-ff2012c32b18", "comment": "Malware payload", "value": "081d6f912f00bf96a6c41aa56e08ec8c2bdf9ea209bf775e8f6964134654389453b53d1dcecdae623e6f2ba41da48730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624243155, "uuid": "7f71c198-9c0d-4db4-8f1e-3dde368de349", "value": "7C351200B6A1C035F1B776F4567AD398A92E79E1A77841CF22E52AEF46343E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624243155, "uuid": "e9816fef-abaa-4cbc-b824-9f116fed71aa", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624243155, "uuid": "354c5895-d64b-46b2-bc84-5f0d9355c2d3", "value": "24576:BXnjpoGxsdmeR3T4tNuzyP0+McWNdaWxk+byIF+IwlM:pxCR3MtNrMjwCXb8In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624243155, "uuid": "3fe7f9b2-378d-4b2a-b865-708e63e1dd33", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624243155, "uuid": "abc3b6cd-4a28-44c4-8c31-4141bb6fa2aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624243155, "uuid": "89abddd6-5357-45fe-80ad-c14df1c794d6", "value": "d7b43ea86a96e3583359b0bea8fffc74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371c5445-d290-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624280240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280240, "uuid": "d4220f8b-a0ed-4749-93ce-a67feb9eefe1", "comment": "Malware payload (AgentTesla)", "value": "7ac29fe081e51995eea18022ca6c05b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280240, "uuid": "ef1bffe4-abec-49f5-93c9-e1f1784632d9", "comment": "Malware payload (AgentTesla)", "value": "d3c47c9378d8b010bf20a995ff24ac000aa47ccd35c110ae1b0e6299b424bcc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280240, "uuid": "51c473ba-470a-4ef1-8816-4fc14f0f2e36", "comment": "Malware payload (AgentTesla)", "value": "a143bee7158b21f3ff8105084103b717dd6c52b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280240, "uuid": "d032d4a8-d29b-4eea-850c-8ef863fb0ff4", "comment": "Malware payload (AgentTesla)", "value": "02830b142242024b2732139409cab61667ec83255d6be0b510816b1b72e88adc61d58467a5f527e42004ff5ac439e566", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280240, "uuid": "adf3d5c7-efef-43fa-ac9f-5f713fdc9777", "value": "74D4235EF384D799E67CD4A26D7A21605B2ED9D4022C903C7EE865830B69F1F032F272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280240, "uuid": "0fb50675-c9be-4f1c-ba5d-364be4d61b8d", "value": "12288:ZyCCgbbOL8snTsG9PIZNQYkGyQkVleEQEGupgQv5rPU6PTbr6d:ZyybbObnTsGpoNXaVvQEGupvpFTbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280240, "uuid": "8ef57fff-c5ed-469d-91fe-1d58ba279bad", "value": 628817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280240, "uuid": "1f966d07-3575-408b-b56a-10a807e94866", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280240, "uuid": "196d8891-b97d-441b-9e0a-9887c9de6815", "value": "Lebanon Khayat Trading Company.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e8e83d-d2c2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624301664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624301664, "uuid": "ab61875b-faff-4409-a1a0-d39569b40027", "comment": "Malware payload", "value": "dfb500a801d3cd450e7f54af9ccb8c4d", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624301664, "uuid": "e27f9807-317e-4172-8e3f-5e44b4c50ec9", "comment": "Malware payload", "value": "d4e71869ff0e236389f9b676931aefd5b898b466910c63f677df9d18d070103e", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624301664, "uuid": "3f99b702-aff6-462c-8793-620e45dadd8a", "comment": "Malware payload", "value": "3ca4848468b81f0d3a6d462f43853e891eeef9e9", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624301664, "uuid": "7e505806-71ca-4204-9216-cc232a6d0685", "comment": "Malware payload", "value": "e11b5b41138e409562aa0e2d901a21a37d1d03883b0986acd08db260e19114415517439ff14ce417d8ce20f519f16dfb", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624301664, "uuid": "dd8d73e7-b3b3-47f7-bcd0-624939d9592f", "value": "AD24DF92F291D91EC65503314DC3C6D55B39FC53AE22870B3784B72F2E36A84EA27726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624301664, "uuid": "5e6345d7-f317-43cb-a4c8-100880944417", "value": "6144:NxEtjPOtioVjDGUU1qfDlavx+W2QnWxuXdRQyJuaTrJVB7HCwKi:5LyJucL7Bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624301664, "uuid": "c6c679a5-b7fa-47f5-9bd4-4c3622f4b10b", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624301664, "uuid": "f763abd4-079f-4c31-b6e9-57f492aef466", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624301664, "uuid": "58f0b14b-917d-4337-a839-79dbd51ba92b", "value": "dfb500a801d3cd450e7f54af9ccb8c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe63d395-d2ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624305485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305485, "uuid": "dc2acc06-46dc-4d44-9bf0-9444cd9a13a7", "comment": "Malware payload (Mirai)", "value": "6c012b0d0cda7b94f5213c717a2b85f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305485, "uuid": "718d7c41-2592-4e3e-af95-e1c9fe9c9eb4", "comment": "Malware payload (Mirai)", "value": "d53aa71473a03b9be08bd467668aa3aa92a211aa6561f249b9f8862426165636", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305485, "uuid": "16307480-6a8b-4964-beca-d0f514d138bf", "comment": "Malware payload (Mirai)", "value": "5dba091c2cb45b4a4adbc98b47303ff266d2d1bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624305485, "uuid": "13385a62-959b-453e-b2d3-98850fee1072", "comment": "Malware payload (Mirai)", "value": "320d767c56557eecc034676b1b4bd37369c596f54c453c839719c8d0dbbd1f25e2139b723e7a3e11b41b33e588f08629", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305485, "uuid": "8825d144-fb4a-4f3a-9238-76251865b877", "value": "A343F270AA0C57E0E6B05DFEC1B743C2ECFE59797D64E8B9110488DA1562221CCB95FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305485, "uuid": "1d5f9f7c-f660-4189-ad75-423dc6f2fa50", "value": "768:0KIFB2M23Y9cvnCto9SqMA1PqMwCI2twpbDjuDShPAi88odgHFn6q3UI1agpqKQg:CFBn23bd9Lr1ZaoqbdFAXdont1agc5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624305485, "uuid": "bbcea99b-c5dd-4724-a1cf-1e64c93e2ac4", "value": 56024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624305485, "uuid": "e77cff24-d39d-4934-bd24-8e83c056918e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624305485, "uuid": "c47b53ad-d614-4712-b834-b823345e1174", "value": "6c012b0d0cda7b94f5213c717a2b85f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4a8e29-d2a9-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkComet)", "timestamp": 1624291280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291280, "uuid": "e8a2a3b7-73d5-42d0-ab6a-07a9fcf59bcf", "comment": "Malware payload (DarkComet)", "value": "dbced1fec389e90c07221f2fd2c19c13", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291280, "uuid": "20abec77-fcef-4483-8202-ad0bdfdf44e3", "comment": "Malware payload (DarkComet)", "value": "d58997e7440fa5314b8a3d2dface651186199e382c3b84afb67649c4baaa7b6f", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291280, "uuid": "28d9682c-cb80-4542-8a09-b33d5b3ef491", "comment": "Malware payload (DarkComet)", "value": "1de2c803f3083941e39e0e5b7e6fe5cafa2c075b", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291280, "uuid": "af0b5030-5ad0-4e2a-926b-4a4f374a748c", "comment": "Malware payload (DarkComet)", "value": "9973067902281d79134679ddaedd46840854155cb46b032aac5017dd2e31452a4c6dbb46b8bf43407f03e426a64578f1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291280, "uuid": "615eb89f-3c03-4879-9043-64d619160660", "value": "AA15C6037AD5FBE6C9C9D4F024A4C16A16663C3325B059437ADEAB439B2C1C3ACB9747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291280, "uuid": "50c7d153-4959-4391-9899-b236696b1bdd", "value": "d9b63245519b223a1f7026d72643602b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291280, "uuid": "5928f141-2bbe-4e48-b31a-ee9b1c563110", "value": "12288:c1N7GYtRi6Hczy4UxkaBQX4V8FkqTiSpAfJ:c7wzy1NPaF/2DfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624291280, "uuid": "ba8a6299-a70a-438c-82cc-f28acec904fc", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624291280, "uuid": "5fd7c9ab-89f6-4e79-bbcb-d63ad738bd73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291280, "uuid": "d57d0e38-be6e-437d-ac7c-6b0aa61ea4ab", "value": "NEFT Payment Reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667d7505-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624259274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259274, "uuid": "dc25ef74-c4e4-4d91-ba0e-61c4373e44cb", "comment": "Malware payload", "value": "93dd86c797349a3aae5b7f543f700c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259274, "uuid": "a6cb5a89-e092-485c-8231-793de16239e6", "comment": "Malware payload", "value": "d5dbddfdf20deea44d4a46defba307a364e8904627d3c67eca8ca4b255b60e33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259274, "uuid": "b3b7db44-2772-4493-9065-b9b7b8ff105a", "comment": "Malware payload", "value": "62fe482da9116086e83f584c94ee59cc6a04c73e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259274, "uuid": "ca1fed55-a6ab-4d30-8d02-5b348b59a525", "comment": "Malware payload", "value": "498dcc135fad6de75e6a4a57771b27e4342fbc2905ef9a38f07e0c7c7a02db0b2c4917262a19d5d47a67c462731dc9f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259274, "uuid": "f69d63d2-e16c-4f40-8b8c-963de5feae48", "value": "B866335539F086BEE1610030ACF63D85B335DD184EB4E5632B2D163F9F7C9893A3A52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259274, "uuid": "9b5aef71-dfc0-4130-a082-9886c6ef273e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259274, "uuid": "39e7c85b-6658-4160-b21f-9464848963a3", "value": "98304:v1OBSfk8bUKAB/mHhqUQ5MJmtGBRUMXMyZHG+r8wSKcwqMhBSFa:v1OBMk8FAfNmXxBZmbx9wqMKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259274, "uuid": "14b9bd8f-ebd3-4bd3-beec-8b1ac1107f82", "value": 6518984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259274, "uuid": "9ad05bae-9849-4b52-9744-5e589ee617d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259274, "uuid": "b5ef825f-798c-4aed-9462-8b5c41175d87", "value": "93dd86c797349a3aae5b7f543f700c02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee11b248-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624285272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285272, "uuid": "89896cfe-d217-4f4b-81dc-01fd910ed1f3", "comment": "Malware payload (Gafgyt)", "value": "816e1efc7898d18015e0ee30cf6dfaf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285272, "uuid": "c65db37c-bdf2-4592-bc72-562a28f6a0ae", "comment": "Malware payload (Gafgyt)", "value": "d60764c6c3089335f76f070089164de3f289eba0efa71192b75afe18c5029db9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285272, "uuid": "265a003a-c1ac-4796-9850-b96bc40fbe7b", "comment": "Malware payload (Gafgyt)", "value": "9893ba505737b8c6ab8b266f708f38ba05f7f167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285272, "uuid": "254b94c7-4415-4401-9594-24b9d8e67959", "comment": "Malware payload (Gafgyt)", "value": "243915a02a79a5c20763dc6a2c30b2e1c1c30efadc6a57a11161f3f67f1bc00a0516b5f3a245792504264acf87d16b33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285272, "uuid": "cfd9964a-5320-49c3-8635-e7325b9afda3", "value": "FFB31993F801DE66F80BEA3604D74B25B630FBE50F531A72621739A69E362D53827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285272, "uuid": "cc9204ab-8aff-4090-a342-68763962d5a5", "value": "3072:sZW+/HwbFRbZTiZl3bb6yWEhJ3/WBpVdOND3mDZ09DqVoQfem:sZW+qzbZTi/qyWGJ3/kdOND3mDZ09DqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285272, "uuid": "144e1d41-9400-4fe9-bd89-10a541d1ffff", "value": 117744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285272, "uuid": "afd7a544-f26b-4e33-8759-40656ceff44d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285272, "uuid": "95fe74b1-cd8e-4860-94fe-69e3d0d2aa84", "value": "816e1efc7898d18015e0ee30cf6dfaf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0e8ec8-d2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624311067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311067, "uuid": "6ca6d0d1-9e34-4ab0-a431-397e2f5a35c6", "comment": "Malware payload (Mirai)", "value": "86502bc551d1b2efee8a4426c4f341a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311067, "uuid": "70140371-002b-4d4b-9904-2047b29d415b", "comment": "Malware payload (Mirai)", "value": "d6502169e9b67218e861d43d060af30c32b0cdfc05fc212aed7bbad1eaf10aa8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311067, "uuid": "b43ff043-757a-46e7-9bd7-46044e2637b3", "comment": "Malware payload (Mirai)", "value": "677d3b94823120ab34c193865ae9a800b966105b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311067, "uuid": "8202f92f-3ff5-4b85-a693-a35ecee62be6", "comment": "Malware payload (Mirai)", "value": "a144d6e983e7070c2062123521a12035512a98e7b8332ba8ef5e0a4052f6040fddf2669a2d9c702f86d079b7f0d21111", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311067, "uuid": "d7676dda-63c8-4679-b1ed-66f31d1db3b5", "value": "9F433A02722C0A47E5A61EB0393F1BD153BFE98020F5F584694FAA4A4276E372586FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311067, "uuid": "1f86a178-c830-49ae-a955-cdda91954754", "value": "1536:zAAyte19QO0+lQNM0NrjcfafViLGNI4FKEwPt+:zkHO0u70NYafVRNI4It+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624311067, "uuid": "e4fd046d-0e17-4668-8d8b-8ff2df4125be", "value": 58456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624311067, "uuid": "b69f06a9-4252-4d3a-b171-15eb03a6d701", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311067, "uuid": "58660658-71d7-42c2-8cd7-18ffb449ead9", "value": "86502bc551d1b2efee8a4426c4f341a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21695956-d28d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624278915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278915, "uuid": "cc7d939e-a739-4305-ae89-cdc31fd8a2f4", "comment": "Malware payload (Mirai)", "value": "bf24df34039c8d4b0fb00207202ba265", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278915, "uuid": "0cbddb6b-7f0c-46ed-9145-52812a9095ca", "comment": "Malware payload (Mirai)", "value": "d66ee3eefe49f9e8a8d6b2c16403dab96602b05b533a8e756f747f449b9657b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278915, "uuid": "ac85e62d-3480-4b78-93c0-2be3681a1748", "comment": "Malware payload (Mirai)", "value": "c97f903d3aeba0a6dd0c6324f60a1ffd94b22be1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278915, "uuid": "844a03ab-e980-44ba-8e9a-cbfad2714ba0", "comment": "Malware payload (Mirai)", "value": "203ae62dbede21cdbcda8a4e2b7e1ef6514dcf55dd638ab9b85dcd66f2417ce4856c545e2955ee7cc10322ed4ab40ac8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278915, "uuid": "a59e4b6b-123f-48a3-9ddc-bde068f41773", "value": "B5B2F699B9D6CA06C9C15177FB0F829A3F255398F1EF33036F122F21668796A0F66144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278915, "uuid": "c6780f5e-8b0e-4e2a-8d00-2d026835e80b", "value": "384:m/BsO0RR3cpd2/PTpfAkL5w9x+B5Xhml9AhFx4eNw7Vs6aSE:mplYcpk/PGKGwnmliSWw7QSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278915, "uuid": "b9efb221-332a-4fd6-80a5-b426a2031078", "value": 25576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278915, "uuid": "4c1d39ad-f83d-4329-9c5c-85550be9cd18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278915, "uuid": "4a9b62cb-4d60-470c-9aa0-c747e0b9893e", "value": "bf24df34039c8d4b0fb00207202ba265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a42455-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624259189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259189, "uuid": "480f1855-d5a5-4f2c-8750-287375039c98", "comment": "Malware payload (Loki)", "value": "e69c00a3b5195c732c9e299e1878f062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259189, "uuid": "f6405edb-9cfc-464f-89e5-2aed725e72bf", "comment": "Malware payload (Loki)", "value": "d691c2a8c6d1424bb3d39b27fa3712bb0b18e3690a49414b1a5afd602ded9bf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259189, "uuid": "311eb2ca-8407-4ba9-a7e8-3f92ea77d0ef", "comment": "Malware payload (Loki)", "value": "061f984da96ed5b31680c89d247c958a5531ae54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259189, "uuid": "68fe9262-b8e9-42de-a16e-08f83eab4949", "comment": "Malware payload (Loki)", "value": "ab2d84095ce65df31c3976b99f171cff6205bf1966d5b2b8edc6330b9ef082e43d1195e9a59e49cf87747a76353c1134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259189, "uuid": "aaaa28e3-fd70-4584-9563-1945ed333eba", "value": "82849AB73104D12DCB77C63D9012E259BE631E831CF5A64E1BC473FD88366866AB2B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259189, "uuid": "adf222a9-cf1b-467c-82c1-1821b4f0faab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259189, "uuid": "5b0b5fb8-b1ac-4252-9872-2c45a72dd518", "value": "6144:c8eOCIutm+cFDIDcu59REqOqzmBH9803zIq9nhaVEt9nIRsoma:7ClcFIDcuNYYmHLR9IRfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259189, "uuid": "333e9a6d-f8b2-4259-bf0e-0f43fd44b495", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259189, "uuid": "1ab31473-73d5-496c-9fde-01b151d9c833", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259189, "uuid": "bbbc85ad-1b65-4459-914e-6a854c6ec7b5", "value": "RFQ For June 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fbc5a5-d2c4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624302654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302654, "uuid": "26011666-86cc-46be-933a-2b75787ae375", "comment": "Malware payload (RedLineStealer)", "value": "58a3a760a784c77b485deef0bfe6d36b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302654, "uuid": "a193000c-d8e6-47ab-a0d5-b40213219935", "comment": "Malware payload (RedLineStealer)", "value": "d6a4b0acc037ba89fd40a55b62ed9b8f29bb5d848d994967724226607ae2728e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302654, "uuid": "5ffcd8d2-ffcb-45c6-b97a-b4b8d4a57c79", "comment": "Malware payload (RedLineStealer)", "value": "9e98e507609af41eed2ab748ff007dbc76c2b6a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302654, "uuid": "51a46514-68c0-44ee-80d3-294e6f5621dd", "comment": "Malware payload (RedLineStealer)", "value": "bab4cfb79826ff25fe4a5adf2d3f79b95881f10c627d91805c6d5ec4517b02e2e66053b2ddead00359231d90ed37a52c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302654, "uuid": "042713f3-9570-4812-b128-e03dc1cedcb2", "value": "3AC40D1826BFC019C4A7EEB12DDC54BAD99994E3A50E723311B4637B8B52784CE4F1BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302654, "uuid": "5598a25b-e904-475b-814d-0d01c2fe5de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302654, "uuid": "baa0cb8e-d486-4791-b1a6-0045d2af0777", "value": "12288:aG16ZEkEkEkERrXmTalve6H+2TCpkc9fOj0JHNpgJ5bnVc9z9JJYIwJrkNjfHb+:JWEkEkEkEE13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302654, "uuid": "9034d9b5-ee79-4b2b-b656-f484b62f9b39", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302654, "uuid": "bf7ccc7b-3b8c-450c-9b55-5a660e07f268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302654, "uuid": "2d608802-e658-4c08-b62c-7aa16a8c44db", "value": "58a3a760a784c77b485deef0bfe6d36b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad42f12-d29b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624285239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285239, "uuid": "704fd427-5dcb-483f-8c03-7ef683abf741", "comment": "Malware payload", "value": "19041bf4f1db01852db086abf9d02df8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285239, "uuid": "7934ab8f-8077-498d-8483-58ede9335b71", "comment": "Malware payload", "value": "d762d7b3dba593c09ab3de71625fd14ed24a7b426a258656fec27deaabbd2f9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285239, "uuid": "e10d7a4e-f36a-41b7-89d3-aec5ab2a8a2a", "comment": "Malware payload", "value": "b4ac9456cca90e4784e3fef48317cf6f197df97b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285239, "uuid": "0143fdba-fa80-4d50-9fbc-8487b9038848", "comment": "Malware payload", "value": "f41bd896b6695f60715583dac8218801fbadd73a5a33edd2eec4404a3f5d8cf1b9c2fb11a15960bc9b69f332011a6843", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285239, "uuid": "d8cd6ca4-7773-4718-9354-2de50b431584", "value": "8AF2E044A2DB4FA1C95628B4BE1387E08BF83F13E3EAC1D552801F319175B31B8499C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285239, "uuid": "fa35b7fb-748d-45be-b6c5-efa128c9ba99", "value": "768:un+CLL0NiL31Uli+6DX9cpqXUau02B4C5xZfY4uVcqgw02TWXr:80QLsi+67Spqvu02B4C3Zg4u+qgw0cW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285239, "uuid": "d5514e7b-89a3-479a-9736-a3fdc8e12dfb", "value": 35168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285239, "uuid": "3f4d1462-7448-4abb-96aa-9b15134361ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285239, "uuid": "f3979446-a82a-4d9b-bdd1-360bf71aa008", "value": "19041bf4f1db01852db086abf9d02df8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28c96b4-d2db-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624312740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624312740, "uuid": "a5a8b9b0-270b-4127-8637-5d781624be49", "comment": "Malware payload", "value": "2035a93ade736422b661f53ee7be5fd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624312740, "uuid": "71e4bf23-c670-460d-a6f8-bb4533d0d4a0", "comment": "Malware payload", "value": "d764ee64bc0d769c20c4823f0981ba1bf17e46c38812cd5036f0e2cfadb23b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624312740, "uuid": "8ada9992-9580-447b-b8f4-21fb6cb0e127", "comment": "Malware payload", "value": "d0fd402b8821cd1d58092ffdb110e36a23447e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624312740, "uuid": "9d08ec39-c20b-4b49-96f3-9fcd4ec5ef1e", "comment": "Malware payload", "value": "95fb01cf7ce63a8412035bf63fa62413cd378a915b42d4962ab4bea5c3093494b940c1c37f5e2d528f85db977bcc9d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624312740, "uuid": "41915e60-d4bd-4509-97a3-f9cec15aff90", "value": "B064C14DCA8B417687FED3BC106DB97BC80A0A1DA9F736D537B29461D69070B1CEB209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624312740, "uuid": "1cb50e1c-5253-4e5b-b0a5-6bcbd8c9beb9", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624312740, "uuid": "45f1139c-0e4d-4a89-b670-3d11113d93d1", "value": "6144:81YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:SYlNRmFJC8y9hrqGdVt5rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624312740, "uuid": "a1e2c733-f31f-436c-b192-fb9f1a571968", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624312740, "uuid": "e5f3f6ae-8b82-4ed5-a112-b980a5a5704c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624312740, "uuid": "14b8b56f-cfe3-4724-b145-8673fd87f5a3", "value": "Z40i5F5PjBRA0v", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc35548-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624303605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303605, "uuid": "10d4cab6-a369-4843-91c7-2f8c5e7a3af8", "comment": "Malware payload (Gozi)", "value": "2478032eded8e67228c05e8e1fdc7a89", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303605, "uuid": "5968cb51-4b0f-4008-8bf2-f4686c0bfe62", "comment": "Malware payload (Gozi)", "value": "d7847c5d6c978eb21740a2c829c08dde017c137840a8006f0720bcaf613b83fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303605, "uuid": "35b08e90-4bfd-4860-9f29-153f45efb61f", "comment": "Malware payload (Gozi)", "value": "a78fce94018bb04e512d8684bcc8818a31f0aec0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303605, "uuid": "79902144-c86b-4542-ae30-d24f3a62248d", "comment": "Malware payload (Gozi)", "value": "6cac1369a8e842cd0f5e97fe1dfec664295049a9158aa9dc05d30b9efe970e86904eb43db2524151ac5a384ebf0ccd9d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303605, "uuid": "bffa9b5e-361e-4832-bbf9-d38579947596", "value": "AA647C017A889030D1F352760F24EB81476DB9665B718ADF3BEC2D8E1F7A4D29336762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303605, "uuid": "356e3ae3-9ad7-4e70-a0ea-e761303eab3a", "value": "8199c7f6de79daeb94a04a3f31dfd4d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303605, "uuid": "79c6bfc3-77d1-4c6a-91b7-d6f52fe5b79b", "value": "6144:Dwfyz7+Vg3teuh/2Yg9AXCeJBhqNgam/HGuF1Fanm:Dw+7Agdeud2Yg9AXvBhq2am/N1FUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303605, "uuid": "88a192ff-cfce-4649-9863-8885649f8e37", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303605, "uuid": "647b2ed6-445b-4834-b841-ab850b387cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303605, "uuid": "dee04349-ef63-47ee-b233-89acec06f5a2", "value": "countTitleGen.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64933fa-d2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624311055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311055, "uuid": "b4ac36df-4ab7-47e8-87d2-c188dca6f410", "comment": "Malware payload (Mirai)", "value": "9bfb660d87687f4efb8108cdc5b059dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311055, "uuid": "d9d49c80-efca-4c16-82ad-b129202ff1a7", "comment": "Malware payload (Mirai)", "value": "d827b6f48c4cce1b945ebac0274d6569b30a1cdd5b208825ab40af1b3b5651e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311055, "uuid": "2aa95cae-bec0-4977-8809-eaeaa0ee6d3f", "comment": "Malware payload (Mirai)", "value": "6f5b209c750a9fbba624527daef6627ebdb0752d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311055, "uuid": "e271bfbf-6ffd-4c64-bf67-76e8454e53da", "comment": "Malware payload (Mirai)", "value": "ccbd353a9a6d157670d5d5c43fdf3cb9fe385183bdabd08e59dee8a9b7499dad237868e59956e1081bc1b52a42f37823", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311055, "uuid": "e6ceb5f6-1d1b-40c5-9b1b-658109024a99", "value": "1D63F996B8C18E11C5D512BAFE2E018E3312676CE3DFB2139D205F1867CA92F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311055, "uuid": "ac59f581-cf85-46a3-bada-aa06fb284568", "value": "1536:6wnrix8yYPDLUw75NZpSLz57H1f4Y4nGcBIeiiccdsUfqEwD:Ymy63UqzZpSf9HB4tccdsUfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624311055, "uuid": "3ad0d62c-463e-4425-a4d7-e07c7f2dd8e7", "value": 71084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624311055, "uuid": "04e453ad-a12d-4b08-b3a3-a352aa9b67c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311055, "uuid": "5a879930-2b86-443d-8695-07ee287e243e", "value": "9bfb660d87687f4efb8108cdc5b059dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dce8ff-d2e2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315406, "uuid": "d3439f8f-7a15-4f1e-8880-c5866ba474bf", "comment": "Malware payload", "value": "b8e1a00d32f6ac937aeb9ec67977012e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315406, "uuid": "ce1b0702-ef50-41f6-a044-2a96baff8914", "comment": "Malware payload", "value": "d859175475c077d7193ce0f1ee703ee4be5dd0804c45da6cbd447b7909c9a09f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315406, "uuid": "c8763879-9f80-42d3-82a0-20433c607e36", "comment": "Malware payload", "value": "7b1253064a1b238e134104377784ca1733885459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315406, "uuid": "846e91a7-ba7c-4da7-bed3-cdf0f2f99c65", "comment": "Malware payload", "value": "eb0d7a3a789df685e78dc11ff04bbd771defa08c6f9a00919b7862154807dc60062f48e72027a44d79f324cd58120837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315406, "uuid": "97e1f671-5a8f-4b59-9492-2d4fc320825d", "value": "6D64C14DCA8B417687FED3BC106DB97BC80A0A1DA9F736D537B29461D69070B1CEB209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315406, "uuid": "069c5bb6-3c60-487e-95fa-ba4ac7bc0c07", "value": "438bece8c96b99d017141b3f95b86408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315406, "uuid": "5eec9796-4508-4aba-ab48-ac72ba69c5ec", "value": "6144:j1YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055trNL4:BYlNRmFJC8y9hrqGdVt5rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315406, "uuid": "fc017019-13ca-4cac-b6ff-1cda97370369", "value": 324264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315406, "uuid": "0621cc44-3ceb-493d-af41-d986147e72c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315406, "uuid": "fd047cc6-0915-4cab-8cad-5e09a9aa0e5b", "value": "ghmEGBKDJgsJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba7f0d1-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624287254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287254, "uuid": "4bc7ae4e-3132-49c0-8e54-d87e246c6e38", "comment": "Malware payload", "value": "740561f2721cf8849dc62c049ca351d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287254, "uuid": "c6bc0423-55ef-4572-907a-5de1d35fd771", "comment": "Malware payload", "value": "d89c68b81a492812f334c6485f8867419efb302da480f13d56ce1e9801c20096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287254, "uuid": "21d5b248-f97b-450b-b61a-e5d8469f5371", "comment": "Malware payload", "value": "c086e663cb3ce73f3f1870b12a6d3fb67452fa46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287254, "uuid": "8e6d2154-259e-4af3-bccc-8aae64b21620", "comment": "Malware payload", "value": "2b8829aa9759c6f1df5ba23e8b56a61363d0d418500d360006ced8e6c3d304254160b0bf49767eb6aaa75d6b268139a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287254, "uuid": "47e93832-a926-4b63-a214-183366f8d273", "value": "E6926A67BFDC2429ED728A7275F525012A35FF412A33C41E95B888658F827872CB433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287254, "uuid": "4a1dca1a-5df7-432f-a41f-5cbdfa56607c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287254, "uuid": "e54404d6-cd7b-422a-966a-4636ae24e060", "value": "384:qC4grPza/peUco2r3f6pmBA3H3lEXhXVn9LczahqY8:qC/rG/vD2r2nlExFVcuhqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287254, "uuid": "7760b034-8bae-469c-b103-e83ac436c6e2", "value": 19624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287254, "uuid": "a6a25eb5-1d5b-49c4-ae28-8a2929373567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287254, "uuid": "918c10c5-339b-4294-93d9-6db292310b33", "value": "740561f2721cf8849dc62c049ca351d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e177e7a-d299-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624284225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284225, "uuid": "eef9b399-c97f-4af0-a06e-37d1b5bcc047", "comment": "Malware payload (SnakeKeylogger)", "value": "3207003cc8d695d5b12699816f32044c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284225, "uuid": "afdace28-1104-4852-b360-462efd7b408e", "comment": "Malware payload (SnakeKeylogger)", "value": "d935261d62e1721db7f65671dc26c56c532b98d8b3335fce23455b2404a39ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284225, "uuid": "0e5406be-ec43-46a0-82d8-f0d37dba7bc7", "comment": "Malware payload (SnakeKeylogger)", "value": "3e269c355c8365f2cfd64ab986126ebfcfc9b08f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284225, "uuid": "cc06e092-0c74-4a9c-8ac7-36cced305273", "comment": "Malware payload (SnakeKeylogger)", "value": "2b4a42d3a9c04dd570385b2533d273c90d5ae0a66504f9ced9247f9b6793723db3927fd6342905fda2efe30c8854e7fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284225, "uuid": "c62b7f5f-793e-40ad-921b-91f2e40522a8", "value": "CC05F89930D0669EC42B8936D9DC3CB4569CB82E120ADDCF40F3A399953F74BDB071A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284225, "uuid": "7e270b1f-0cae-4a8e-942b-2a32b2486157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284225, "uuid": "68064d9d-11a0-42e1-9219-48378ab2bc6a", "value": "12288:nAiETJmIdkMrOigQ8KbiCaX1Is5PPPYRpX/6pARs7POjSZR7vURQJotP87MYB:Af9msLgQm1tVYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284225, "uuid": "7bd04bf7-52ea-40b3-9cde-170d4d110425", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284225, "uuid": "c840b8b1-9cd8-418c-a24b-ed6327698298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284225, "uuid": "b074e68f-0645-4bc4-bb91-e09a778dda69", "value": "quotation #60152 almaco.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655793c4-d2e3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315966, "uuid": "efe2100c-1de5-461d-b002-1ab6d9bae4bd", "comment": "Malware payload", "value": "bc2f1dba703a71a429bdf02bc88770ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315966, "uuid": "3a0299d6-c72f-43d1-8b43-8881e07483fa", "comment": "Malware payload", "value": "d94f4e30720b7aff1d489d8ed9e9483dcd448c440e0b198dbbd85339be28032e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315966, "uuid": "9a0cf671-5370-4749-97b4-f724b9435ae8", "comment": "Malware payload", "value": "7d52948e9c41add4d79e1346fa323ced17542dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315966, "uuid": "8264d4d8-4732-46c4-a156-77147fe3c20a", "comment": "Malware payload", "value": "0644c3793cad532a5815145992bb54bea9dbc630565b684a2c71ffd53a9f7638e214434b7b86842ee6ad28486d8b57ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315966, "uuid": "68039b93-f2b8-433d-b7eb-3b54f7e35e7c", "value": "9C44B109CA8B41768BFDE2BC106DB97BC8060E1EADF737D937729461D59070A5CEB218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315966, "uuid": "fa812619-8048-4d02-a358-f79d187020f1", "value": "6144:l1YlNk2GVPYzoBEuC8Wr9hrqc5FDlD6PX055c:DYlNRmFJC8y9hrqGdVt5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315966, "uuid": "e2a9c56c-36b9-4b5a-8f1a-04c35bdb3990", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315966, "uuid": "101d7e05-dfd4-443b-98cb-4f2b6c567c64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315966, "uuid": "c8944fc1-867a-46ef-8c8a-860225ea491c", "value": "X5GMses7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb1d28c-d25a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624257191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257191, "uuid": "65ff274c-9a1d-4d3d-990c-9c6fb24e0b4b", "comment": "Malware payload", "value": "2ea040f3cb37473015a313e65e8b4884", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257191, "uuid": "3e56d69e-f34d-44bf-93f3-f99bb7fd75f9", "comment": "Malware payload", "value": "d9524c214d92e17bdb61d6c4859d29cf8fd9e55d2fac5507030fc609663ffe01", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257191, "uuid": "988d4725-f172-4706-92ce-b9bbde97548c", "comment": "Malware payload", "value": "c718904de4b7b56af67dd10c9ace8d51c45d51d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257191, "uuid": "8b968cd1-6cea-402a-9c79-8b14305f4a71", "comment": "Malware payload", "value": "64ac86a0a0f54c6e12ca0798a0cfbb33176596fdd6546e7035067a82ce3683d1d0cedf51b952128b6e366d5dea88aa1b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257191, "uuid": "e1ab6e46-c4f9-4edf-8705-99edee921e76", "value": "7591F86AA75C18D1D44484F7C8887F1911BBFAD382D71394B62EEEF3075A208EB46A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257191, "uuid": "7428ca6c-15fb-4c2c-b63e-4ba2eceae24c", "value": "96:RirEM7sHheuAiaooQDVrWdpNypJLwQMUJ0P5mHcjaPK:RirEMuhRAiajQDq7UMU0b2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257191, "uuid": "ecbd2c3e-3b25-4c3e-8428-d7c0c454d463", "value": 4320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257191, "uuid": "44e4e57f-c588-42f5-9cb4-9cbf94c9adb9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257191, "uuid": "8757953f-3316-4536-a97a-06e2184359ed", "value": "ORDER 387746.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6acbf7-d2bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624299231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299231, "uuid": "2aacc9b6-c20f-4cd9-ac28-54099a2bd1fe", "comment": "Malware payload (Mirai)", "value": "0a28f84247738d72188f920e38e59ec2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299231, "uuid": "986a29bb-21d8-49ec-8216-a6b128a68c69", "comment": "Malware payload (Mirai)", "value": "d9ebf732c27c3c8dd6116a06584ae4ccbf3d642d92017bb9dbf25ee0b62135db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299231, "uuid": "deb880cf-eec2-4d84-9120-445e284a6a54", "comment": "Malware payload (Mirai)", "value": "f423c1c1cefc7fe5924733342ba412e9f96f35c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624299231, "uuid": "7f4b0af2-0990-4ce8-b893-9fa3367ec1ff", "comment": "Malware payload (Mirai)", "value": "2395b338d09d2193b03991780b8c2e69a7281533b8f0cce4a28944e590070e813a763632f02a82b557543a291c1b8e45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299231, "uuid": "19410102-50d3-4213-9e23-37c2da0f4c50", "value": "152302432093BA03E43458FE4562CCCEB65AA6BDB1BF7AA725490D154C38D93DCB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299231, "uuid": "e488313c-11a5-4f51-b529-79909e14eade", "value": "768:ITK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFj9q3UELWt/iw+kvBGg6+fYtrBHI:q12O1LCNguovDPH7TcroLWhiw+kvBGg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624299231, "uuid": "ac8a6840-20c2-4a47-81e5-de8908f5dcc7", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624299231, "uuid": "a2c3b70f-d017-4672-aca8-1fcc0167fc05", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624299231, "uuid": "04d9e970-c473-4d7c-8437-15fcde9b80e3", "value": "0a28f84247738d72188f920e38e59ec2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9412ee3b-d275-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624268800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624268800, "uuid": "7e42cbdd-0e43-4458-b233-dd00fd00200e", "comment": "Malware payload (CryptBot)", "value": "001bb11bc92ea340fb0c0b2d337b48b6", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624268800, "uuid": "cc6aad36-a587-4684-a38e-8bb3c130684f", "comment": "Malware payload (CryptBot)", "value": "da034c11f0c396f6cd11d22f833f9501dc75a33047ba3bd5870ff79e479bc004", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624268800, "uuid": "49b4355d-7d91-4aa4-9f33-db2a4260d7aa", "comment": "Malware payload (CryptBot)", "value": "ba0913d7eb66898bc4cdb962fd7db8d6a14764ac", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624268800, "uuid": "0f931db7-4c26-4f56-bdab-88064ff96c5a", "comment": "Malware payload (CryptBot)", "value": "624412b3e1b88d917f3b928ca19869f15249388721f56c15f1de7b5c84fee629fb91abeb446adc5c80d499fafc607d78", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624268800, "uuid": "8bae463e-e63b-481a-9834-1de80bbfa527", "value": "13F4F110B691C036F1F7A2F849799369693D3EB2A72854CF11D127EE5A747E0AC32B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624268800, "uuid": "4241f84a-dd1a-4aa9-be84-2b458c3033e6", "value": "123708792297e850a475b64837725c34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624268800, "uuid": "a63f60f7-4c68-4549-ace6-5a08c7e89e13", "value": "12288:VGuiOA2G9ey+7k1WNhxF1e7ozL3QmLS82pbnRTazvroD0j0B1ZIMrhmAvpLVjox8:VyOA2G8jhxuUzTQm+ppbnuvrs0j0B3mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624268800, "uuid": "eb57ae6f-e7f1-4ca0-a68b-097418ab245c", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624268800, "uuid": "1912d498-8cbd-4774-9b91-8a916ab50513", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624268800, "uuid": "7ea4a126-ab18-4b84-a4c2-96014e5ec953", "value": "001bb11bc92ea340fb0c0b2d337b48b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cf723d-d27e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624272695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624272695, "uuid": "ccbfd3f3-c9e6-4c3f-a1b5-ea6239538b29", "comment": "Malware payload (Loki)", "value": "8d8ecd00343a88fae634d6da2241d754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624272695, "uuid": "d67a6713-cc16-4e14-b5f2-4715bf70bfae", "comment": "Malware payload (Loki)", "value": "dac4bcba8c26214458b1acf0eee8696df8e070027d1688013482bd3352cb2b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624272695, "uuid": "0018be18-a23b-47d4-85b3-d0277943ab11", "comment": "Malware payload (Loki)", "value": "1184472d52265b38e25c513eff6d683ea95d7df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624272695, "uuid": "5989eaf3-4fcc-49c0-ae9e-1f4b6b9259ce", "comment": "Malware payload (Loki)", "value": "6983a6266b9243aa91d1d2c6213c3e62be1e306791bac53a86b1701d78bafc91b3e43981555a77e1c784f12ec34bf94c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624272695, "uuid": "b83a3ca5-aada-4462-9283-65ba5c39708c", "value": "0025AE220ECF422DE2754FB557B0BC8782B7ADAA3605A2253DC031ADCA375D9CDEE511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624272695, "uuid": "0a76d7bd-d639-4008-a80b-7e55bab9a499", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624272695, "uuid": "c5c2af50-16c0-47d1-bb3b-5b785ac0a006", "value": "12288:4/k/XWFHmsMSMPQipP5xYqUc0MqRLy7nrg6MYP+JOrgHzu5uieA7:Ek/oHRipLs1CM68JOail", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624272695, "uuid": "18ba7165-96d5-48de-8694-99279ad9734c", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624272695, "uuid": "35f3fd36-bfdc-4e3f-b10d-fe6308e55703", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624272695, "uuid": "a01c1597-83ef-4029-ae21-5d965250e38d", "value": "fW8OKRxAMYlXtGW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5c4fdc-d25c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624258207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258207, "uuid": "a8c277b4-f6cb-4112-95d6-3e1380eefc6e", "comment": "Malware payload (GuLoader)", "value": "ee93a692c31033de3fedd144b1153d3d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258207, "uuid": "30806233-1ec6-4e7e-b737-8315644c8fe0", "comment": "Malware payload (GuLoader)", "value": "db12524b47193775807b6650b9516504d23716618b7f406cd2b98b213d79c6ce", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258207, "uuid": "aeaf06a9-60cd-4dc1-b252-f1029a7e0654", "comment": "Malware payload (GuLoader)", "value": "651a711830e674c2d69a19a95beb43172aab45f3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258207, "uuid": "2f741399-e45f-4b39-8844-5881c19d4820", "comment": "Malware payload (GuLoader)", "value": "f06e2305707eaa8d8eb4a7aa8cf2910476f2e1e31591aa36f63759b389b6254207f36aa80a3d37dcc1ece13342b9c9e4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258207, "uuid": "e0aceee6-bc20-4dd3-bcb0-9a919892d8e9", "value": "EE5533E1BCA24316E00841B73245CE5990FD8D61B324D10F5BC13665B979AB8FFE7A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258207, "uuid": "d7fcb281-080c-4094-81c8-4635f4d3894e", "value": "24576:5R2LpEi3hXFvfJpK1RwLCRKXTHIAR8un0Cn/yPRtV3VeG2AFMfy:fqhBfO1RoZXTFRraPnVEG2AiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258207, "uuid": "b430aaae-830e-43e2-a93d-5c3f700be3c2", "value": 1354752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258207, "uuid": "8412603e-ca8b-4850-b448-72da6e6016fc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258207, "uuid": "6a02c2d5-c562-41fc-a322-40664d6c9c18", "value": "2 007465563737365478389.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627e4dcd-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624298781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298781, "uuid": "84e34603-83ff-4d89-a607-eb181bda5ebf", "comment": "Malware payload (Formbook)", "value": "4973f29c105dce3837d78fe291531f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298781, "uuid": "6468fe52-df02-46dd-8f79-52c54db87348", "comment": "Malware payload (Formbook)", "value": "db387432df2ea972484d10ca491dccdc021829bda4bdbd9e043acfaae645da33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298781, "uuid": "c3704813-b8c2-4000-a806-ca229f30f5c4", "comment": "Malware payload (Formbook)", "value": "9dfe8708c4a5c4260988dd024d396774d300fdb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298781, "uuid": "b139eb64-cba7-4ef5-814d-3bb9675ac423", "comment": "Malware payload (Formbook)", "value": "c7bdbcd9345de08efbee9ded0742f004b8b1f5cfc4dd6d0cef2eae671749ca24c3f4938359fe7bbc9e582ba25e306972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298781, "uuid": "cfead846-c495-4071-9cc0-e3bcd44affe8", "value": "30F4D0303AD99625F27EEF3555E071809BFEF623A713C2593DA502850623F81DEE253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298781, "uuid": "1ae8d83d-b0a9-4b10-9daa-538600845e90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298781, "uuid": "fff1617d-df93-4cec-9a1c-db6ddc1e39b1", "value": "12288:SlxTWFHmsRRNrDl73l9cf4UxM9b2/JV0B20nwfsCpvtvKTms1WYTl:ixMHj/rZjl9cbxkba91dyakWYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298781, "uuid": "8641ef70-9c62-4542-91b7-f6fe599489b0", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298781, "uuid": "6a52c3eb-81e1-4722-bee1-0db28fb380e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298781, "uuid": "7e5a65f8-38b3-40e6-872c-2b3d9b88966a", "value": "4973f29c105dce3837d78fe291531f6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2d9d3c-d2d6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624310288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310288, "uuid": "68b2a1c3-73df-40e6-bc4b-ced0a61c48e3", "comment": "Malware payload", "value": "119e0f235dc12f11b39dea225fa35fb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310288, "uuid": "07816a59-ec0f-45fa-aefc-9662f86f0180", "comment": "Malware payload", "value": "db6356982c1b324e7e89336abb544b93e9fa3b09b0d1a8fcdfaa22527a5cf66d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310288, "uuid": "afc8ac46-6d1b-4265-be8d-959b0871c291", "comment": "Malware payload", "value": "d9247391b9ee0fdd6b695ac465c29b4a7bb17cb6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624310288, "uuid": "ddd2e077-3468-43b2-9ea0-50d709d6e610", "comment": "Malware payload", "value": "7f916f3bdaa3ff42008fc54616c9f214d1162b25d9098aaf4382e2e273520d8430c3bfbf33069d9561d6cd9cafe136c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310288, "uuid": "f3a87081-21e8-43c2-9b4a-3e20f9048691", "value": "6F2489F5338812AAB48B1BECC328624601ADD17535E414C9FBE6896BFCDAC53243977D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310288, "uuid": "8d693479-f86a-45d3-b93b-0b956ae180c3", "value": "768:VbHIO8TvJ66JsVeahFpCwEzrBMxEdDcpTI1a2Cp+b8A4q7oXXASyzbZvnRhFiTpI:VboO8TvJ66J88XbZsH50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624310288, "uuid": "3a73114e-2812-4184-a250-ca8e6d655c37", "value": 220168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624310288, "uuid": "409cfb06-5890-4c89-bc62-bc50814b795f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624310288, "uuid": "7f47a521-cead-4b40-b944-d5f66922c5d2", "value": "XAML.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aaeb57f-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624259147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259147, "uuid": "b3333dd0-4629-4d73-be70-66ccad5b9df3", "comment": "Malware payload (RedLineStealer)", "value": "a35ace6ceaacfc8caa07ac11ac24bf0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259147, "uuid": "454ad7b7-d69a-447c-a7b1-1094faad692f", "comment": "Malware payload (RedLineStealer)", "value": "dc3025d6c495d29d9bc249a8be56b37f61b93b621532861cddf6bf0a4ceecb09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259147, "uuid": "cdc82d6d-b0a2-4f19-bcd5-3689fea9c814", "comment": "Malware payload (RedLineStealer)", "value": "6b567ab0a798570afdd026932dcbff36788ab80e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259147, "uuid": "ac09319b-de76-44b7-9cd6-25f8e4b66719", "comment": "Malware payload (RedLineStealer)", "value": "70c848bde7aac1c505fb507a59c7cb69b00ec02470a9f6ca53171caaa52a83729ba18b7614dccfe4480db3d461331ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259147, "uuid": "9fa52362-eb5b-4e45-9591-b85da693dd13", "value": "0884AF11F7A1C035F2F752F84A7693A8A93EB9A16B3450CF12D52ADE1A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259147, "uuid": "68a3883a-4b39-4810-adea-8865c3e17a0d", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259147, "uuid": "6c9e6a11-bfc3-40a8-b62e-1428157f7a30", "value": "6144:xoHzHYjAiouTNv3mfFiu87Ib4gKRLmmgNJYOhMVlD7q4KrsNueKrifBzU:izHyAiouTN6FiB7IEgammgNJEVlBrlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259147, "uuid": "b6746374-afb7-4240-8e05-a780c7cc505e", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259147, "uuid": "e4fbeee5-e7b3-4157-b6f4-504411dcc5b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259147, "uuid": "88beb3e6-ee69-41ac-a925-c136105b561c", "value": "a35ace6ceaacfc8caa07ac11ac24bf0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850067f2-d29d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624285954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285954, "uuid": "433e630f-74cc-4514-af8f-287eadf325b6", "comment": "Malware payload (AgentTesla)", "value": "62410b828b1f1c9684143bc1f95fa90d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285954, "uuid": "8e2ea7fd-a84a-4031-81f7-6f809304d62f", "comment": "Malware payload (AgentTesla)", "value": "dc7425b3b801c9b4b84bbf1beb398893b8bd2cdcd4efdb97a54f7124f733e3e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285954, "uuid": "e27cb871-fb82-4f1c-8739-b67208836b5f", "comment": "Malware payload (AgentTesla)", "value": "7354c045e668395d4e4f653149272d3028862808", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624285954, "uuid": "2ff95ba5-7da7-4c9e-b1a8-7dcca55192b1", "comment": "Malware payload (AgentTesla)", "value": "50bea6b0e3d379d56cfc0d9a71820c16b3052fe3c653b37860d803c87bb61c85c16649f7e6a18f7e77354055feeaf2d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285954, "uuid": "d77a26ac-3eaa-412b-823e-e36477e00c9e", "value": "4235BF220ECF426EE2754FB557B0BC878276ADAA3704A2253DC031ADC9335D9DDEE416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285954, "uuid": "3a2298c1-5848-400e-b0b2-7b7c32212bcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285954, "uuid": "90bb5244-b9f8-4d16-a260-c4b710355093", "value": "12288:zZXkWFHmsBSMPQipP52HTpkSyjC/7rslzFu0T73tBsvZYfKzKiLUoI7Za:tXvH2ipEkKsHu0T79BsOfKGiLUoia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624285954, "uuid": "e4f036f9-6b11-4b22-90d0-f9ef5b3e5865", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624285954, "uuid": "7da2fd27-c917-42e8-a7e6-c20bd5a913ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624285954, "uuid": "cbf22b6c-af78-4cc9-8e2d-29be4e5edfbc", "value": "7qVSiXSTdETO7cX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7438d626-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624258868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258868, "uuid": "b85c8fb9-f52c-403b-951f-84c946c13c05", "comment": "Malware payload", "value": "1ef565125b92bec9766369c997694ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258868, "uuid": "5e36cb43-231e-476e-84ce-6ad387ef96d9", "comment": "Malware payload", "value": "ddc7f4b27173a2b55af5fc5550fb41cd05d28fca932d1eb79d17bea79cc30b9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258868, "uuid": "f2333a98-dc82-4724-8397-ec777499f80f", "comment": "Malware payload", "value": "9ddea371f965b67fa491141621cfb574a1e9725c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258868, "uuid": "99d9a012-76ea-4a38-a69f-4f3ff6368cdf", "comment": "Malware payload", "value": "e2ddb88763a34c644bd1153885ff42104b39585ab5b27d0067192a232092d03bb4a048a044692fd68437bd09624f4958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258868, "uuid": "2506da9c-bb0e-4490-b4dd-0bd2ebdf862e", "value": "E866335539F086BEE1610030ACF63D85B335DD184EB4E5632B2D163F9F7C9893A3A52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258868, "uuid": "fc722a1a-b18e-4f53-887b-c78e7a911d34", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258868, "uuid": "52ec257b-a5e1-4286-bb24-e58ada587a2c", "value": "98304:y1OBSfk8bUKAB/mHhqUQ5MJmtGBRUMXMyZHG+r8wSKcwqMhBSFa:y1OBMk8FAfNmXxBZmbx9wqMKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258868, "uuid": "8a47b00c-6ddb-4336-a733-d98b85703c8d", "value": 6518984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258868, "uuid": "545929b0-ee87-4030-bdaf-3d0264845bed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258868, "uuid": "4dd7ebaa-a749-49df-9a6a-49cf13f806e3", "value": "1ef565125b92bec9766369c997694ad2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f827b1a-d23c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624244150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244150, "uuid": "13991071-ee63-4260-8ab3-13e89c81c30f", "comment": "Malware payload", "value": "53cc9d24a2dacc86819a40ac71819870", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244150, "uuid": "54f1e4f5-454a-4358-85df-4d5e7d00cd3e", "comment": "Malware payload", "value": "dddc6e6e5271c1c1cebb0dae200186971a8111d804ecc087398900a80c37c5f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244150, "uuid": "61d61fc7-e0e8-4466-98fe-f924eefd7dba", "comment": "Malware payload", "value": "8f384ba44fb080eec53f030f39827d5a13d7560c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624244150, "uuid": "86e39cb9-41e7-4121-bce5-923581c8d43a", "comment": "Malware payload", "value": "db7883de0985cec41f4e01f03f534cb593bec0fd79b208fbc10eb0a4f762b2fe874b7f14bcdb81173de03bf6e2353858", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244150, "uuid": "9339451c-c1ed-4194-a2c2-25e565cb1845", "value": "C393D64272888B16D96419B1C1EF353413F26DCB1B32D6953F4C53FD1E823A29E9AF89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244150, "uuid": "96efeca0-63f1-4d5d-9bc3-129585010464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244150, "uuid": "aee3555b-e6f9-4666-bb9e-401d7b65a95d", "value": "1536:t2GWWE8Czm/hutvdMnXYHfliQv9Xz4M2KKZHZcpfR0Wq7xwTYR:4fzm/4tVMX8EQNz4M2NZHZkrqVTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624244150, "uuid": "29c48ec6-9bc6-4756-b603-3761236b17df", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624244150, "uuid": "75d90b9d-af81-49e5-9c06-50b50f81bd19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624244150, "uuid": "82597606-1015-428f-8d5d-64704350c8b5", "value": "53cc9d24a2dacc86819a40ac71819870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7788cc71-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303541, "uuid": "7fdb6425-9fd8-44a6-96b2-71ef43540d26", "comment": "Malware payload", "value": "8333d57a044a01797f6e120b4c1b1dc2", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303541, "uuid": "27928478-3a63-4c46-a89d-eed4f14b9063", "comment": "Malware payload", "value": "dddcc267ce697c5ec06aacdaf884d2eced853e987aef4767472d491db9903258", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303541, "uuid": "93aefbeb-d332-44b4-a1e9-c12680accfab", "comment": "Malware payload", "value": "e726e247c84dda75df1963d5899c22093291062c", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303541, "uuid": "ac958592-79ab-4a3c-8085-1f5e7e73c5ad", "comment": "Malware payload", "value": "5a4b2a588675a0570f66ddc924c4a1ece1a3d1e793b25c53bca8a76ed9c76e440a4d74c495987a6faa8fbca56e7d7eba", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303541, "uuid": "b71cdf09-1454-4503-9c3e-b741e004120b", "value": "6A51F9CB28514E7C5A6E2C1B3EBFD1899CA4C4519612D87FC9C1ACC209907E4AC57EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303541, "uuid": "9a9cf24c-fe03-4dc4-8da5-1b145516aaaa", "value": "48:Krju5zIWajWeiD0Bt2gaEtJr2LgXapy1CTtO6NRJyU6EzQuK9eazupq5Vp9R0J9c:K4zIWaSbABthugXap6aT6ERUo6tUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303541, "uuid": "bf15c185-64c0-4922-80bc-e4b78e0f844f", "value": 3086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303541, "uuid": "135fe8d6-e45d-454f-bd6b-cf40e5e5913e", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303541, "uuid": "462ecdfb-dd70-4175-91f7-f65b87084929", "value": "vbaQueryCount.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0018a053-d290-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624280148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280148, "uuid": "dde55981-492f-48d0-a773-26425830acb1", "comment": "Malware payload (Formbook)", "value": "5a9964c917bdceb12686e1072cd7b8bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280148, "uuid": "17b91e8f-37b7-4a7c-ae2b-dc3726131ad3", "comment": "Malware payload (Formbook)", "value": "de5a91649e654f5273032c0e524491e7ac1c6260e1140472c72b031dfe4fba91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280148, "uuid": "2a587102-ef60-47c7-b0b7-55a59b8142d0", "comment": "Malware payload (Formbook)", "value": "3196a7cf89bf13cabf2dcfb8495674d73c3ad1ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280148, "uuid": "5b3c7d02-dbb0-47d4-8ba6-b9f568172721", "comment": "Malware payload (Formbook)", "value": "5737f22334a46ceddfb099c29c6b85951a5db2fc1af1b012df89f1594139fe99e1873c7b85839313ad85d203ca168f7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280148, "uuid": "0642b04c-eb16-4781-a648-307bb957d043", "value": "1A35C0220DCF472DE2754F765BB0BC83C2BAADAA2605E2153DC0319DC6336D9D9EE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280148, "uuid": "7eb0cd23-a93e-42cc-a1ab-e7918fc7201e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280148, "uuid": "e676da74-38df-4879-87f7-594aadeeb684", "value": "12288:mvzSMPQipP5qf4Ng+mL6Ker8bdJKM60aO7VGddHrJFJI7c+8mETWEHmsM:lipM4NEDeQbdJKMZa6KHrDJIOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280148, "uuid": "d8431fe0-90d8-446e-a2cd-9962a350548c", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280148, "uuid": "eb722a99-fe5d-4423-a8ed-441c4f2e75cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280148, "uuid": "a4f73fdb-e777-417a-b20d-def298b83efc", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b664754-d2aa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624291495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291495, "uuid": "33460434-4ba6-4235-8c0f-13a783d116f2", "comment": "Malware payload (AgentTesla)", "value": "23993104d1263bd9c00aa7c6b7fb0e0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291495, "uuid": "cd1254b8-6998-43cc-be90-672ab717c0e2", "comment": "Malware payload (AgentTesla)", "value": "df730a5c1462ced883e78b64dbb7d34c7687b3e0b20914559a87a3719496818f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291495, "uuid": "d6b80eb2-80da-451b-83df-50b9aaec448d", "comment": "Malware payload (AgentTesla)", "value": "d35c0048d623baab9cbb9224a32dc4d740d44989", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624291495, "uuid": "3c2b1a04-1f77-4ece-88dd-0f90fadaa46b", "comment": "Malware payload (AgentTesla)", "value": "26b4390d4ada47b321170af5d20db5e58cd5c0fcad9bf09dc57346d920ac0940d5db52b8d7f88bcc7a6848b520f9b572", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291495, "uuid": "45720c6b-4263-4662-93c8-393d16e310c1", "value": "56E4F1B0345E624ECEDD41B8242223F146BB7E57FB5BDA5C7CE8390DABA78821304975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291495, "uuid": "e9e64d0c-e6aa-41ce-a929-1d404163be8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291495, "uuid": "827a77f2-0b53-4a5c-a116-a5e2021a488a", "value": "12288:XjxTOH2OA+1kM9MeWTMCnYC+e/+YwBw4b25nBJy1HhUnqmF:FMmPMXWw+V464b25BWmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624291495, "uuid": "bb9c436d-e715-4b2d-998a-fcbd92626cc6", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624291495, "uuid": "062ade05-c11b-408e-bd2e-a8e4a28b2b97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624291495, "uuid": "1a5d97a1-f861-40f0-8083-a135724658ff", "value": "Gp0zNckDo8v3Gk2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb666de-d24c-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1624251071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251071, "uuid": "9ca3226c-049b-4de4-8c6c-78a18a0c0752", "comment": "Malware payload (FickerStealer)", "value": "a2d07f48198ae3996d17627f4039f22c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251071, "uuid": "34822a61-a6ca-403f-a605-f9a399430671", "comment": "Malware payload (FickerStealer)", "value": "dfac601a1adf9bfb8f732721db2c08461e91c5766497e951e568dbb2a718f212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251071, "uuid": "441de532-1722-4eea-8d9e-34ef37b1e401", "comment": "Malware payload (FickerStealer)", "value": "1e095d72b9d39d7ed4bca06a766e8eb0c9b00b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251071, "uuid": "61301d49-bfdc-4122-b6dd-e662960e86a7", "comment": "Malware payload (FickerStealer)", "value": "16448e6dc591acb7d569bd99f704e273f0105e7a3abc9b27f6ee0205c26683f48b3646638b2f4eb025ac29c45f1bdae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251071, "uuid": "032dda25-c547-4b00-8fac-45e2c2ef8809", "value": "EC85C03FF268A53EC45E1B3245B39250997BBA60A81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251071, "uuid": "e490ddd7-caf2-4688-82ce-e8b1c61d4738", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251071, "uuid": "cf908d06-7648-4324-b5f8-0d3a31363f75", "value": "24576:t4nXubIQGyxbPV0db26WQ7qKnCssv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdOd:tqe3f6Z5C1SffPMWrQ0ZkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624251071, "uuid": "d95a7dc7-3903-405a-95a6-1a6f25f077f3", "value": 1764575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624251071, "uuid": "fbf52bb5-3d56-4884-9c02-0da37773795d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251071, "uuid": "5f556de3-25b9-41f3-8bac-ca4629acd2a7", "value": "a2d07f48198ae3996d17627f4039f22c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5892e5-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624259313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259313, "uuid": "bf2fb28a-6b22-4bab-84fb-0f38627bb0a1", "comment": "Malware payload (Smoke Loader)", "value": "406d6d5d08850ed5ef1d0877f19b01b8", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259313, "uuid": "0478c4b3-1980-4b97-8b8e-5779ff2fe8ca", "comment": "Malware payload (Smoke Loader)", "value": "e11501c9e16a2f69751da6f5d8d2e5ff3023eea48baf5008a197e20a2ffd66be", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259313, "uuid": "8e435270-49e3-48d2-ba71-bbd4de13cc4d", "comment": "Malware payload (Smoke Loader)", "value": "4fae0cc21779cc6e1b7dff17418e1e439251f96c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259313, "uuid": "97d9cd4b-5e2a-4de2-9cf3-4c1daff661f9", "comment": "Malware payload (Smoke Loader)", "value": "1c8abc9c9ad54b0c3d21192fd86985d95a4d5d82dc8f2c03fb4d80c69b89446e7a17a29da6dd94e2697ef8ca1a53e42a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259313, "uuid": "93b56d29-90f1-4214-80a4-3121476a829d", "value": "DB649D00AAA0C035F7B662FC497A937DA52D7EB05F2490CB52E52BEA56347E0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259313, "uuid": "79a8c707-46f3-4a4a-96fa-4ba8f11b732a", "value": "cef982a39394466fe74a88f9214df2fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259313, "uuid": "02415fad-206d-4dd3-abfa-311317a9bd18", "value": "6144:3WEIQI3QbqPwaHE9JiQuVCSP83In3rncJSq0CsGNKri:GQAQmPwaHE9J2V7P8Yn3rcQXJGNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259313, "uuid": "3e9cfe59-f920-479a-b798-aab2d5d94809", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259313, "uuid": "c76789c7-e1d0-4365-8454-55029e8ec3fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259313, "uuid": "a38fab39-d40d-400e-94ad-e803cf46e7a3", "value": "406d6d5d08850ed5ef1d0877f19b01b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c477d67-d290-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624280249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280249, "uuid": "c5565c60-eb8f-40d7-882f-cb51a4d96c5d", "comment": "Malware payload (AgentTesla)", "value": "61c1b4ee1cb75075feb216aef8aba272", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280249, "uuid": "1443833f-8c44-41fb-b6cb-df45f42e0321", "comment": "Malware payload (AgentTesla)", "value": "e17d086f09f1c049a00df3de7aa66039905a9141cea3d4345001c861b8a7730f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280249, "uuid": "50561e9b-1e93-48ac-b878-8ed344469474", "comment": "Malware payload (AgentTesla)", "value": "a45273ee45b40a6c5191e0e5df0a85d197d22f4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280249, "uuid": "a54b31ea-2592-4074-b93e-87443810444f", "comment": "Malware payload (AgentTesla)", "value": "ed6033ec26f07208a90facf25666368534b29681af04ea7982c47b8beb08b506beb54fa10ca4cde38b0f0cced10daa60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280249, "uuid": "b043f6dc-cdcd-4a7a-bc9f-72a9570b833a", "value": "0525B0674ECF876FC26808B95731AC4782B24DA92544B3213EC075BDD93B6EEC6AF501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280249, "uuid": "e1568a4d-c3de-4cb6-8a0b-9bc0f611f31f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280249, "uuid": "69633834-b815-47f9-ab08-43670dfee9e9", "value": "12288:8XSMPQipP5X3OL8yVTsu9PIZNQek2yQkrleEmEGup0Qv5bPi9PGPTZpj:xipB3OJVTsupoNDErvmEGupblq9oTZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280249, "uuid": "1a3065b4-5068-42aa-96c1-87166e81b416", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280249, "uuid": "27b64616-09af-4116-9667-566f5194300f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280249, "uuid": "48fafa9a-e870-41b8-b413-5e7cd2dae129", "value": "Lebanon Khayat Trading Company.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7382db6-d29a-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284723, "uuid": "bb088b7c-ffdf-4746-ad8a-9ced2f2e5ed0", "comment": "Malware payload (Gafgyt)", "value": "72b0eb6e58ce8f5e69ab55763f345bd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284723, "uuid": "e3467d69-409f-45f1-82ba-1f4f65b3f719", "comment": "Malware payload (Gafgyt)", "value": "e1bae2615c122a0614ff5ff7016f167e4e4c0a4d9b8488882997d2bc581e15af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284723, "uuid": "47458369-e7b1-400c-bb6d-6eede835655a", "comment": "Malware payload (Gafgyt)", "value": "6198c42b151eb99cc700ada1a92886beed540e01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284723, "uuid": "589cf2de-e2ca-4d8a-bdcb-33eebc5a96e4", "comment": "Malware payload (Gafgyt)", "value": "c9c090ccc65fe650065b5d9322ac19bc9ebb710442cae16fb0e51864004963fc8fa158a9b0cc99787a7b805ba9339e3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284723, "uuid": "e8395cd4-d436-4bcf-a078-705b71cbe5f0", "value": "C0B33901D5508B67C2D217BAB79F825D37332B6893AB33115A24BFB82FC279D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284723, "uuid": "861f6b8d-9316-410f-89f1-50ec64314dc3", "value": "3072:JPaWFbuKq9eD3QSZOf0TH5dbmyBQC2gXzCj:JPaWFbuzSZo0T7myBQC22zCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284723, "uuid": "fb037749-51e1-4781-833a-15bc4020e9e0", "value": 118114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284723, "uuid": "cd7a764a-b1e4-4862-b310-aacb68a5536e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284723, "uuid": "3768268d-b7ef-4ce6-9ed4-1d4b4f240f29", "value": "72b0eb6e58ce8f5e69ab55763f345bd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c457755b-d291-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624280907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280907, "uuid": "d8078311-e124-4d78-9853-0bc3cc15bff2", "comment": "Malware payload (Gozi)", "value": "81a57502787fd832d141625494bc6e61", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280907, "uuid": "6bafe256-ef5c-47f1-a37b-641f852e006b", "comment": "Malware payload (Gozi)", "value": "e1c8e34791daee490ba154c10dddf0d43d4cc6910fb08debbd5c722e722ea551", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280907, "uuid": "1fd2201f-68cd-4141-a13c-02eae7e8ba7f", "comment": "Malware payload (Gozi)", "value": "73025e06eb644652e5f43d050663b041f687e53f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280907, "uuid": "532d022b-29d3-4813-adb5-9e34011bffe5", "comment": "Malware payload (Gozi)", "value": "a12d91322e14a2ec7a091036fd3ae2b475d8b9963e02b8d231ea5eb1f9c0055e4fd00af76f9174812e3a93e5cbfe5682", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280907, "uuid": "039632b8-f5a1-4e0f-b152-bf5cd490bc3a", "value": "18647C0179889030D6B262764F24EB810BBDB9651B71CECF37DC5A8E1F394E29376762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280907, "uuid": "6bcd7c6f-919e-42b5-80e9-31cc42167cdd", "value": "cafd4f67066e4431e00f052908a506e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280907, "uuid": "290898fc-38a5-4d17-a676-38b297e8b9ab", "value": "6144:oUtzB0RzsWEV3SwowlR81T/F19W6fepyq85t:oUZKRzsthSwBRq/5W6fepyb5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280907, "uuid": "930be163-9bdc-40d5-9924-b046a3e81056", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280907, "uuid": "7ffbf395-bb2a-4c63-8787-4bccd9ec7989", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280907, "uuid": "a998f9bd-581e-4a16-8dc3-49e462ccb7bf", "value": "focy1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb08580-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624259473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259473, "uuid": "878e1238-01af-4432-914f-ec9d9f3e9b64", "comment": "Malware payload (RedLineStealer)", "value": "e44e86177b277615e9db73e3973aae2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259473, "uuid": "383fd58e-8dce-47e4-974c-a9f753fcb56b", "comment": "Malware payload (RedLineStealer)", "value": "e221654e32c4d4ef05f651f7836b7ccbd0fd8b53eb3d8b0d85145dcb0a3043dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259473, "uuid": "5471f27e-4c42-491d-92a5-aac68683417c", "comment": "Malware payload (RedLineStealer)", "value": "5af1c8ba4e026f72dfa21c8bfaa53398fa8aafb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259473, "uuid": "167ec9b7-2528-483c-a064-720a0d7b4b96", "comment": "Malware payload (RedLineStealer)", "value": "5b037bbeef42e02efca09bb3a53adfdd9bb022bbc306a09eac07e4ba24de55f65401030e079209ea45ee87d101ac40d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259473, "uuid": "b141e029-363d-41c9-a867-efd2282382bb", "value": "6B84AE10F6A0C035F2F756F44A7693ACA93E7AA16B3450CF12D52AEE5A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259473, "uuid": "2c94b8e9-943c-4b20-bd35-3caa2fb1dfc4", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259473, "uuid": "d0472c31-6538-4792-b1d3-eb1e36737810", "value": "12288:XzRoAIoudNwF8R8yXS+Nv9KJHm9PTvqtdJRiVlV:X6AIou7Y+Nv5Tv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259473, "uuid": "88fbc6fd-b9be-464f-b610-8fe63e3db3d4", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259473, "uuid": "518c4cc3-d711-4d83-acde-baea3fee4c66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259473, "uuid": "4fd6bae0-b213-4c66-acee-c390c77df680", "value": "e44e86177b277615e9db73e3973aae2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043dc251-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258250, "uuid": "8aae72a4-ba6e-4465-8688-a9d0fc18d2e9", "comment": "Malware payload (RedLineStealer)", "value": "8844ad342ba0011a1ec8ce5965fe7c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258250, "uuid": "c38e2f3f-ee28-44ea-be4c-d711b5737bb8", "comment": "Malware payload (RedLineStealer)", "value": "e22ab9556cc49aede2a1341750986d0256b2cb35b2932a5fcbc2a6a97f47452b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258250, "uuid": "99ebaf5b-ce84-4547-94e7-39bb951423e2", "comment": "Malware payload (RedLineStealer)", "value": "3413443f8aa4b51939cbd04cb23e29c585d33c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258250, "uuid": "6800b411-d74b-4c00-a31e-9abac5499b54", "comment": "Malware payload (RedLineStealer)", "value": "8a0dcd62d1938dec2d9d64bed031a36d984228670339f74e2f30915bf8889db850febb8d80a265aa191079fe8e99d899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258250, "uuid": "67879e8b-ee17-41b0-8403-044441d7ecbb", "value": "3084AE11FAA0C035F2F766F84A7693B8A93D7AA15B3450CF12D12ADE1A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258250, "uuid": "ecfccba6-8efb-4354-b536-e992cf26575f", "value": "727fc829aa749656d14688aeebd4d86d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258250, "uuid": "532b142c-aacb-458f-9960-20a6d8ff7e04", "value": "6144:TgQ2jIAwNrO2/4tZOGhK8Vgq/eIqxi9GlwtGJ6C5xOmbhkwoHxslyKrif:J2jdwNrOw4tvK8Wj89Glw40wbYFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258250, "uuid": "7bf36a52-8f5f-4740-8969-a93056e2bcb6", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258250, "uuid": "b84005ad-1b32-483a-9545-dc397e8f0f15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258250, "uuid": "e3834176-8396-4cf4-a90e-09933205a94b", "value": "8844ad342ba0011a1ec8ce5965fe7c01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edc0cb7-d25a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624257060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257060, "uuid": "80a8c68d-e101-40ff-b004-a0b774d97402", "comment": "Malware payload", "value": "048a031d90b7a0144aff18781d491926", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257060, "uuid": "85f01078-591c-4a4b-8f3e-77863586a22b", "comment": "Malware payload", "value": "e2f73f4cf5b53c79aec72e02904ef216c11b755d6263d193141be3c317310127", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257060, "uuid": "f338d554-c65c-4d74-b919-19e2c6e7bba0", "comment": "Malware payload", "value": "2cd12d4dcc979ae6019c3203d6f7bcc52e00eb8c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624257060, "uuid": "da53caef-4eaa-4306-8595-dd8f725aaf83", "comment": "Malware payload", "value": "46ba252cfa187e9194f2a9d9bff20afe46f09be2f7eca2a5280f11842cdff605b7d5c2d7e4c288c890f2e8f8349a9647", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257060, "uuid": "4fcfc2d0-215a-4366-8ab4-1a2338623e56", "value": "9DC3002AE70F0915DF94A67B034B4A8A45FCB73DF38500A579AC973437ADC2E4A2197C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257060, "uuid": "f2437732-b5db-4104-a8ab-80e67837ad33", "value": "3072:H1+p89fcsBP+upLONOHNkEWvf8CvYTy9ovcOm:H1+MP+gHNkEWvfoy2v5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624257060, "uuid": "f42e8143-a806-4905-82ad-ff35da303927", "value": 120282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624257060, "uuid": "c5984ffd-cce0-4219-b4d8-ebcb82b549ce", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624257060, "uuid": "6d85f059-6014-40b5-b317-28031562734c", "value": "ORDER JULY 2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f338d18b-d2d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624311050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311050, "uuid": "49a08bc7-ae4b-40d7-a4cb-7b2a764e82d5", "comment": "Malware payload (Mirai)", "value": "df6bc6b270de8c5d62745952ea7138e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311050, "uuid": "34c5a022-9b11-43aa-ad90-99f3bb7fd44a", "comment": "Malware payload (Mirai)", "value": "e353fd21ca2ebacbff3e51a7390b4557d8e3984c2046fd95ca578284029a0cdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311050, "uuid": "c26a09f0-42da-4a92-b26c-ee1138fb1954", "comment": "Malware payload (Mirai)", "value": "cf96c81888ee3d1bb8b83310075b6c255acbca7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624311050, "uuid": "b62fb5d1-5db6-4af7-a8e2-32a55af6bfb0", "comment": "Malware payload (Mirai)", "value": "db6cfd72e2f8e10e1e2cc75f9dbf70bb18acc647b2516b9ea5603e5035d7b3824830c70af73ebdb37de92aa14a77f560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311050, "uuid": "d708ff40-5148-41d8-8d98-e9f865e90183", "value": "06535CD9B401DE3CF85BD7B980274D06B6222B6456930F27A7A7FCD3AC730949D16E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311050, "uuid": "bdc6b618-ed0d-4b6b-80d5-e6a989cdb623", "value": "768:peDCAlqM1iCuxRO/C+onx6sZotu1eee1ASgXjuUpIF3oi8wzIEn:paC+qSuh+hsZoc1RwgXjuGIFj8uIEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624311050, "uuid": "523c50e1-20ba-44e7-a95d-53c735c1e788", "value": 61472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624311050, "uuid": "2527d717-e8d6-41f1-ad12-8b9042df078a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624311050, "uuid": "c3653214-ec65-4d22-a6ba-8c3da039c65e", "value": "df6bc6b270de8c5d62745952ea7138e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fb3291-d2bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624298764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298764, "uuid": "e618e73c-a243-4d8b-ac51-29a2693c9857", "comment": "Malware payload", "value": "e4f3b7781f5a839be837cfee99761bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298764, "uuid": "6727c816-30f5-4fef-9865-f692a74fa52b", "comment": "Malware payload", "value": "e65ddcb1e8d85b5d13ab1aaf5d9747feea1e3e442ed82773640d740627f4d7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298764, "uuid": "4b6ebb99-1cac-4516-9435-df220019f1a2", "comment": "Malware payload", "value": "515684d60c79dc3f23b6246413684910b12135e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298764, "uuid": "6f8c35cb-720f-4d51-ab9f-9fbf55de89dd", "comment": "Malware payload", "value": "14a348a50059d98440cf120c867886d904b9c4019f55a81c87226f647da3af532123be73c809f1f6d645056bc4af7608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298764, "uuid": "dec70d0c-4828-4b43-a7f2-b7f765400762", "value": "5AF4D0303AD9A615F27BEF7955E071819BFBB623A713D5593D6002C50623F80DEE213A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298764, "uuid": "457176a1-f9ee-461f-978e-eafe64b7a0b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298764, "uuid": "a4c04e64-1ffc-4c2f-9780-64a4441835e7", "value": "12288:Sj0p+WFHmskrRLRmJflZB3hpVB3JU8ZgGhbbCPQazd5tHOjsSRIsq3WYTl:48dHSVmRrB3NBZvZgkCPQatJSR/oWYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298764, "uuid": "08f332bb-9008-4010-ab89-e22f284de0bb", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298764, "uuid": "0a7ae188-24df-44fc-b5a7-969108713e6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298764, "uuid": "b683d364-4215-4687-9cb0-311195a3d842", "value": "e4f3b7781f5a839be837cfee99761bc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae5ea4f-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624259094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259094, "uuid": "a434c3a0-d1ed-4170-af67-7b2cb8e9d6b9", "comment": "Malware payload (Stop)", "value": "96b12deb465649e8b64aae21f7818aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259094, "uuid": "2628cfc3-865c-4be0-a07e-9be5540efb94", "comment": "Malware payload (Stop)", "value": "e68d87007d27253de5c6f9267262f58d57492627eb0c0d2ea63d22043fc6db83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259094, "uuid": "ac628468-e1f2-4bfe-8403-66fd1c9481a8", "comment": "Malware payload (Stop)", "value": "20d424518051330cf46503df470f708e0a530b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259094, "uuid": "59301cec-c6f1-40e1-986a-5c43cd76891c", "comment": "Malware payload (Stop)", "value": "ebe648b66237b5a81f69d77bdfffcdbbb46dff3348acbb54d917933c9363cee04b9f3cdde0c3ca9a84e3b25741c5c7e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259094, "uuid": "0ff896cb-a44e-4b2b-b7d4-b8f1907d9d50", "value": "70050201A790C034F5A732F81666837DA52E7EB2132051CF63E56AFE6634BE4AC31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259094, "uuid": "8a918b62-af19-4482-b998-0d758c660be3", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259094, "uuid": "b7661921-9d8b-4ab7-88d8-9ab3f8836929", "value": "24576:pSn8P4RpSVOT7i/1YjN+IqBrX4Zuvhsy:uS0i/GJ+r7Hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259094, "uuid": "d57dc038-dbdc-4445-8bb8-68a09365c459", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259094, "uuid": "0280f8af-64d5-4a7d-9cd0-3284c4d7bab1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259094, "uuid": "f71a010f-5f96-42eb-9679-9b5cddeb3f0d", "value": "96b12deb465649e8b64aae21f7818aaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817c958c-d293-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624281653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281653, "uuid": "0e1bad76-4d6e-4012-af77-c1783f958750", "comment": "Malware payload (Loki)", "value": "040fbe414ccaebe8c4b617ad2f52bf41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281653, "uuid": "34d2b5fe-85d7-4ae5-9a8b-4ab798b9e612", "comment": "Malware payload (Loki)", "value": "e735babcae80a63829841ea9cd844d6bec8602babc5321cc63751ea96bb1ba82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281653, "uuid": "9ebae694-a40f-4d16-8440-65abef5f3910", "comment": "Malware payload (Loki)", "value": "b7858b29b7a42fbda30043f16854394b05db0040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624281653, "uuid": "7fada940-653b-4bca-9f11-987b5f0570fc", "comment": "Malware payload (Loki)", "value": "04321852b54e80d7ba52b13a4c483df361ed8669970103e9bbdc8978f580d2625122b63fdd61969560f3b68c4f5eab82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281653, "uuid": "59c5c8b8-3ba0-4370-a926-55700530c26c", "value": "AE25BE220ECF422DE2754FB517B0BC4682B7ADAA3605B2153DC031ADCA375DADDEE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281653, "uuid": "ed683b85-1ff6-4783-ae44-4e71e5d2676c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281653, "uuid": "a9d1afc5-3a14-40bf-a20f-1657559cd6b4", "value": "12288:+aallWFHms4SMPQipP5d5j0I4BoP5Iw7Xi5eCR/KyTQQBiuGm+JfdSW:0lCHlip5Wu5fy5eCFNQWGmUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624281653, "uuid": "11a95928-930d-4700-a4d4-967823082136", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624281653, "uuid": "fed37dd9-28c4-4caa-afaa-0d0f853111ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624281653, "uuid": "f49cc4a6-3d19-4be9-b037-ab7316d30417", "value": "Purchase Order-020POR040557 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82940824-d2a8-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624290675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290675, "uuid": "b47fb860-f45f-44ab-8ecf-6891e4ba4ff1", "comment": "Malware payload (Quakbot)", "value": "87a037a7ccc5918243bec9acc0e6c973", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290675, "uuid": "c3323b4c-0a22-4fa3-9a82-175d264ab043", "comment": "Malware payload (Quakbot)", "value": "e73c6e159f026873f92f0b451fa4ada471dbe788d959fdca0c4eaf76af95529f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290675, "uuid": "b741e835-97f9-4d5d-bde1-63340c59eb3a", "comment": "Malware payload (Quakbot)", "value": "fbcf9040635c7ff857a08868d2d4093bfd809709", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624290675, "uuid": "f46843c6-073d-420a-b849-40631e72775c", "comment": "Malware payload (Quakbot)", "value": "13476ccb45145a63531e8d5b01fcd5ed4a54e274960a826b340fc3e02960e6a8b02bfd1494f775d95b6f4e6f32cf054b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290675, "uuid": "b379fc0b-dcbe-4be2-9788-672f4d13ab2c", "value": "0DF4CF217682E471C2F766360F64E5E10B5C74241B745ACF32E83B7F1FA84E3962972A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290675, "uuid": "ceee9f8f-85b2-4ff8-bcdc-3f05701121b9", "value": "d67f9ece491ca951fccd592592c16db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290675, "uuid": "bb608ddd-2550-428e-b633-a1681ab51e98", "value": "12288:azKiZ3YOU0q2rbomA+57bEKvVssQr4sp7+9c3YpOkOgJykAUT0D6m3n7UWZHMINg:aNUG57bEKv/Q7+9PpO+JyVPXACxpkzab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624290675, "uuid": "35032637-bbf7-4229-8339-88889389cffd", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624290675, "uuid": "cd80d229-f284-42a4-8662-15cba22d95c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624290675, "uuid": "e6fa2b3a-6914-4a61-a207-4d63fb11ba51", "value": "2021-06-21 15:47:49.638806.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be687b78-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303230, "uuid": "bc4ec8f7-edd3-4126-b4ed-27665f3c0e0d", "comment": "Malware payload", "value": "337e8b960323d115244404f9e828c896", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303230, "uuid": "86d44cb3-00ef-4d92-929c-3b0ee8b1e4c2", "comment": "Malware payload", "value": "e793667a46743a4a0dd951ba0ee0f4714be6402304c87255c1d388f2c6396207", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303230, "uuid": "8f2e1152-c186-4202-a6ab-4bb78c5a0314", "comment": "Malware payload", "value": "170126b91cc155c867cfa4831858ed416e843577", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303230, "uuid": "f5a139d5-70ff-4c70-bc1d-1318143b6f7a", "comment": "Malware payload", "value": "be5905b05d848b167d8eaa299dc456f7fbc62304c374996cc740bb720f2071490ac9e0958ea7433e9b6a4ea107d5936d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303230, "uuid": "0c72feff-d913-468b-90a8-b8c7b53aff40", "value": "4033C054F101DC50DF2EED78A5BA20B076AB0AB4F390AC976C80925D59B116ECF3B7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303230, "uuid": "ffafd7d7-d7cb-452c-b855-51268a86cffc", "value": "1536:/5DSIQIOf7SieU6ZDvxjxcpAr/USvhWyUH:/kIWSiebvxju4/UchWlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303230, "uuid": "37a825b3-a363-4343-8f78-150f5355323c", "value": 51347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303230, "uuid": "9b87cc3d-7f45-4f8f-95bb-9bbd8bdcced6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303230, "uuid": "f3e544fb-b415-4a8d-93b3-53769eb453b9", "value": "question-06.21.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0eee46-d29a-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624284708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284708, "uuid": "98d43b7e-9209-482b-ab77-accafdd2ce17", "comment": "Malware payload (Gafgyt)", "value": "a4c11e27c5102c81cdfd09be8edede7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284708, "uuid": "b115d8be-a8cf-47df-b9f6-01349079c5e2", "comment": "Malware payload (Gafgyt)", "value": "e80bc50e7269130e1ac852790de2afbc9e7bfb759fc2050b7dbaa39afeefe8b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284708, "uuid": "1f2db0dc-96a1-41e0-b06b-a92bb04972d0", "comment": "Malware payload (Gafgyt)", "value": "2d7e0c021ee0bcf9c9f6d0f21792af3b5a02b21b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284708, "uuid": "e470f434-c106-4154-a6f4-9ee32acf90ff", "comment": "Malware payload (Gafgyt)", "value": "8ef705b65ec23d4ab94bf019d668a80a14635d15cf49f274707839dbf97e68b4c18b080239a85d825aa89fd570c3599c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284708, "uuid": "0d601b22-2228-4c60-b2f8-4469e0ff2b3c", "value": "66A31A41E9418717C2D327BBE79F439D3B362A6897D7331566347EB02BC27982E39620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284708, "uuid": "c8c99904-1145-45e5-b480-38199a500239", "value": "3072:gct7IewarS9/cKptuyTLowijQkXE4zdAm:NImrS9/jFHowijQkXE4zdAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284708, "uuid": "a768c594-f007-41a8-a883-d44a103422cd", "value": 105612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284708, "uuid": "a6ee3d60-95bc-47a6-ba71-1ec3af91e0db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284708, "uuid": "90879298-f076-4863-b0be-8327ea444567", "value": "a4c11e27c5102c81cdfd09be8edede7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a913eb40-d22b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624237052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624237052, "uuid": "c89c1408-0a12-45e9-b588-814f9566e494", "comment": "Malware payload (Loki)", "value": "e09894bf14893c505a994a382c4d6a62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624237052, "uuid": "7ead243f-3289-41bb-9a38-c370a0998d87", "comment": "Malware payload (Loki)", "value": "e8744060c5568394940066bc2a220430ab1d62fbaca0239d7a51352f666220ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624237052, "uuid": "c8b3c947-154c-4972-b241-e2ab50059461", "comment": "Malware payload (Loki)", "value": "b4965362953a87cc854e08f1e5a19d9ecc10871e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624237052, "uuid": "6239f63e-d116-4952-80d8-50cc5b136cd3", "comment": "Malware payload (Loki)", "value": "9fc6a37ba1d8841c499bbb1026f4ca82dd3b2db7c74cba258a7847abe4cdf04346cbe9550378fc29872bcf29a5213213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624237052, "uuid": "f8d34393-51e4-4ac7-96cd-2af91734d4eb", "value": "1515599E361072DEC857C971DEA82C64EA517C7A970BD203905736AEAE7D887CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624237052, "uuid": "8f8e60af-f672-45c0-8331-47d609d7edd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624237052, "uuid": "a044ec66-9ae4-4a34-bcd9-3588388dbfa3", "value": "12288:srmCXtPX/vmhLsGbLfZsBGZZXMoei1HD6Q6ZBzUx+e7+1FAMDMkEgoyro5XdV8vJ:srmCXtPvvc/LfagZZcontDyZBzaD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624237052, "uuid": "91c2047b-945a-46ce-a66d-aa9774efc819", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624237052, "uuid": "231d5cb4-2f88-4b95-ab8b-c070a4cc1e19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624237052, "uuid": "c2bf45ea-1768-4ee2-b502-e0ae25523afd", "value": "\ubc1c\uc8fc\ubd84(\uc2e0\uaddc)_10115_[\uc0c8\ub108]_210618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3551dac9-d24c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624251031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251031, "uuid": "208f90ed-bc9a-485a-9c34-f43b86061ecb", "comment": "Malware payload (AgentTesla)", "value": "d3104d7693c655d11ecc6d3e5170f8f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251031, "uuid": "f08c8a1c-5303-4841-ac4e-e80f97a7ba26", "comment": "Malware payload (AgentTesla)", "value": "e8ab524f833350ddc4ba223cced952993b04e7b40607a35ee968c1a6ca96d2bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251031, "uuid": "eec86645-fbd4-43b1-8742-0997377638d1", "comment": "Malware payload (AgentTesla)", "value": "575efa10aafea7e6992ab9468dfbab054b2f5a43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624251031, "uuid": "aa63923f-8c85-4b6b-b41e-d7b2f65fe59c", "comment": "Malware payload (AgentTesla)", "value": "ec1c02f5fe62b91feaba01c7e7be0245f95f62999e83712139067c25dd381ad3a6ec1f69ec58e9570dcdedafe99cc9b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251031, "uuid": "ac34582c-c0dd-42c8-b8fb-b169716f08c2", "value": "FEF4CF3039EE6119F5779E781AE436E2967FBE677B07D85C24E4234A8723902CF40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251031, "uuid": "2dc59dd4-1558-4aac-97e8-9b947657ce58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251031, "uuid": "7d88b37d-8ea6-469c-a3b7-53e8b7a3588e", "value": "12288:EtveLtWFHmsv5QQO967sEPNWFHS1SRhwDPIM3WGbgpqnhJvHhU:EsL6H8z67sEES1SwIeWGvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624251031, "uuid": "60239ac1-06b1-4e36-b163-e1c679fae1e0", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624251031, "uuid": "1a3c9c78-2fb2-4633-b8f7-e81d7c75e231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624251031, "uuid": "a85e89d3-d859-4e6c-9d4a-bf63a3354a66", "value": "New Order - unitednature- 34526745727_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668ecd93-d2ad-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624292775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624292775, "uuid": "c35a0f8e-80ae-405c-beb1-5d5ec094eeae", "comment": "Malware payload (RemcosRAT)", "value": "ab8599dc273e54982990ab8ecac56d09", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624292775, "uuid": "0b77d1fc-e1ba-4aa7-8822-19d04a53f0c6", "comment": "Malware payload (RemcosRAT)", "value": "ead77969ede47d608de0812e7095ab55080c456131c17507ccf5e4fa4ea740c2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624292775, "uuid": "80b8ebba-2f07-4df7-8aac-a1cb0e942ed5", "comment": "Malware payload (RemcosRAT)", "value": "d0864346e3067327a000ae5503dfb2154d952523", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624292775, "uuid": "a86d5fae-9c3b-4ea9-92ab-463ca34e8749", "comment": "Malware payload (RemcosRAT)", "value": "5864fd7dcf4c95e6cbd2775ae48ed729b0646dd0c1debd9f1551caea988003682f1d6d19a9ac6ae104ebf1776e2c7b67", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624292775, "uuid": "d94b3056-c920-4887-a8b5-9591a4153c5e", "value": "FBD4C6472D2DAA22B172F8204E1D59115C64FD623DB702E3D6A63E4ED67BCE00B6DF60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624292775, "uuid": "be409d05-0d32-42cc-987e-93c16a97f2a5", "value": "6144:hcxF9DHn4H7ndkOxQutzsZxIuBji6LAe//lv1bui1LM2n9CQT+a3QmJ:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624292775, "uuid": "6568b008-bf85-4a5e-9a52-bd3af01d3b34", "value": 634125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624292775, "uuid": "cf8845e9-f5ec-445b-ac10-c6d97eaceafa", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624292775, "uuid": "2d2fa181-d04d-4c20-96b7-31eca8c05a06", "value": "21062021.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24192e5d-d2a4-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624288798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288798, "uuid": "8a39531c-51c4-46b2-a3a0-3a6d22bf4cc6", "comment": "Malware payload (AsyncRAT)", "value": "7b25379caa4340a714b210dfd01fd5f9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288798, "uuid": "80e102d4-d57f-4f7b-b341-5df674d8f46c", "comment": "Malware payload (AsyncRAT)", "value": "eaf087b8fe0cf69bed568070ae460d63483525842d4c84c7750ef87c4985e622", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288798, "uuid": "92bb50b2-dc22-48df-918e-7fb344a92700", "comment": "Malware payload (AsyncRAT)", "value": "5d0cf2954a43c613f270ee9c6ea2e74798787725", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288798, "uuid": "ac4f4f4a-1e5d-49b5-a170-d8e99ac14736", "comment": "Malware payload (AsyncRAT)", "value": "85fefec2bf73f19be5a6a8521b4f4d7fbebcba5237b32c81dc42efb6e2f64d9980971303e6f662cc13665dc985124daf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288798, "uuid": "963d24ab-c64d-467e-b4be-5b985a86ea4f", "value": "CE233C003BE9823BF2BF4F786DF32255467AF1673603D5491CD4429A5A13FC29A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288798, "uuid": "b82cb080-19c0-448f-846e-43bef93e5caf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288798, "uuid": "c997ebe5-9c8d-4677-a4d4-a51e4a341427", "value": "768:quwCfTg46YbWUn8jjmo2qrVOhzTehhoBgFyT1BPIfmRZN0bepJYUhU5r3R0vXN0u:quwCfTgp/2rhVYi8e+bepJbhUx3Rq6+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624288798, "uuid": "fa9d9735-ced4-4bb2-89af-52eac71a5ffb", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624288798, "uuid": "5cd05d49-75a1-4546-b26b-7aed39740f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288798, "uuid": "bbfafb2f-6362-4d2f-884f-82a72d15268c", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223a1439-d290-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624280205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280205, "uuid": "8af5c457-ac51-44d6-b53e-ba1a894c3a99", "comment": "Malware payload (AgentTesla)", "value": "6eb466599f0dbcc8be66902d8b7d5a4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280205, "uuid": "5e52b9cb-a261-4eab-bc9b-d9f0672c0a9e", "comment": "Malware payload (AgentTesla)", "value": "eb382466c9d42e533fb2fdcd053f0603a5d62a455b7ccf3fe5fa856bbcdcf3b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280205, "uuid": "0a4a2808-b51f-4028-aec4-6751486d0beb", "comment": "Malware payload (AgentTesla)", "value": "91227f37b00745e69db5dc62c6ecf4bd4d3a6c21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624280205, "uuid": "c7c6722d-b9eb-4fda-88f6-1e66d21557ae", "comment": "Malware payload (AgentTesla)", "value": "a60f93f0707075c7f8ef1d11329bf2805f2e498e01507bfe13468d55d03ed86b0e06ef22208cd29f7d73b693954bfa9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280205, "uuid": "3785ace0-276e-4b04-a444-cedc4c032fbd", "value": "2035BF220ECF832EE2754FB557B0BC8782B6AD662705A2113DC031ADDA335D9DDEE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280205, "uuid": "2dfac7ff-2620-418a-80cb-e866f11f9918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280205, "uuid": "3355f32a-7415-4626-81fd-dbaa6b35d26c", "value": "12288:a7AsWFHmsWSMPQipP5OCXwkPRWuDop8/O1CVSSx83Lo2yy+YicMcFbLIk+lCair5:aUH7ipPLop8m1mS33chYi4oCL4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624280205, "uuid": "a18826ea-d697-4cab-815a-76f76a8d3c04", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624280205, "uuid": "f9d1d747-e1d0-4e64-9df5-196e1ed0162c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624280205, "uuid": "1462f89d-41fd-4ee0-9868-650703af8444", "value": "QUOTATION Q 01668-R1 - 4KW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b3fe7b-d29a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624284712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284712, "uuid": "4f78d314-d4b6-4643-803c-843d13833a6f", "comment": "Malware payload", "value": "2cb53025ff4c2c7aaa4557c80d5aa2e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284712, "uuid": "657ca547-76e7-4154-ba48-00cf71ef8996", "comment": "Malware payload", "value": "ebc627d04715e162a8409c00d06df76d7401b32f0fa77c952c14ddf156c0f451", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284712, "uuid": "0d8d7aed-1f35-484c-b729-c31812a7a1eb", "comment": "Malware payload", "value": "fd7d9a41ab66d64b74c15e9624a507bbcc4218b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624284712, "uuid": "39b94939-c31f-4382-8097-58a269f3710c", "comment": "Malware payload", "value": "67b16bb0c290f2e71e7251135713c927d9712780f8e9db47b5bb77a2142615664cc258ffaedb878934f4916b27c553f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284712, "uuid": "c5d1d1d4-31b5-4bdd-b9f5-38843e375f95", "value": "F813E16121C41039CA3654B6F0AF811773ADB6BCB2F74192126D2372BAD2146B1FFBB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284712, "uuid": "b2c0e9c5-a6b4-4dd2-99db-33eb4e36f223", "value": "768:TDvW1cRMCOH6YzoC64wKyDUa8krI2+LiaXClSy+1MGWU2HZ44ZUvYLhq3U7qo:TDvNRE6SyDxroLiP+6C28A1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624284712, "uuid": "a966c82f-c630-48c7-b54c-897e44e6e85e", "value": 42480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624284712, "uuid": "b5731ba9-5400-45bc-bc7a-870ee5321bc1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624284712, "uuid": "6563bf92-c2be-444e-a428-255afc05943d", "value": "2cb53025ff4c2c7aaa4557c80d5aa2e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155b3df3-d24f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624252266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252266, "uuid": "58d97977-1d26-49eb-aed3-ea14c13c5795", "comment": "Malware payload (RedLineStealer)", "value": "a06452a19e545a2f6834703b8b37b9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252266, "uuid": "a39b0f99-0a1a-4b05-9782-82c556149ba0", "comment": "Malware payload (RedLineStealer)", "value": "ecd73911b6344d486d5447ea7e749085658a0475c8d4184c10ddf59a4382df2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252266, "uuid": "97d70928-baf4-4891-a93e-16890d79d9a2", "comment": "Malware payload (RedLineStealer)", "value": "445e4100421374a9eed43c9c4a4044198a8eaa02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624252266, "uuid": "17bf3177-faf4-414c-bc4d-4ab67660eddb", "comment": "Malware payload (RedLineStealer)", "value": "42519aaf8f9aad536dba0119bcb994410b8551b6e0bbec524df17ce4fecb2829aab14fd535009ef03cf839363e553cc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252266, "uuid": "a25d38dd-c56e-4283-ad8a-991c6a9ff9f4", "value": "B7B49D1076F61B65E5B9C7F5076462844BFA322E682EE61C4CC770CF28B2F419952F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252266, "uuid": "e7d873cc-d1e6-4e9f-b74a-ac4f628c3525", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252266, "uuid": "65075a70-975f-4f26-959d-c2c8be37f033", "value": "12288:JdrO07sX4NcxwOX/t+BK5JH60ME9DDqvgz2Ax:6XCIwOX/YKX6jE9GG2Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624252266, "uuid": "5ec60958-3dc4-4274-93a6-b8aab7b4e5f0", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624252266, "uuid": "aa9d9922-fe49-4bd1-8c8e-8fa76ae1ceea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624252266, "uuid": "d2bfb620-ca08-4085-81bf-31e6b3f4912e", "value": "a06452a19e545a2f6834703b8b37b9c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d918af27-d2ba-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624298551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298551, "uuid": "b64595dd-7e59-470a-8265-2dd338a882bd", "comment": "Malware payload (Mirai)", "value": "5a8801f5cb9fa710537c1ce36d8b4d8f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298551, "uuid": "35211bc2-4a1b-4e71-8b14-5dca474ebb0c", "comment": "Malware payload (Mirai)", "value": "ee35ff39b0eb14b9180ce9d56a2fd3dd6d22d9f55a1e7fef88ed0294254dafcd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298551, "uuid": "685f3cce-0501-431f-bbd1-bbddae3b1082", "comment": "Malware payload (Mirai)", "value": "618a789cd8ae0610a22809e9fbc46ebf0c756ff4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624298551, "uuid": "bd7364e1-ea7b-43ce-80f7-2f0e2bb581b6", "comment": "Malware payload (Mirai)", "value": "97155c4753943c204fd84dd323722331f50b0e48f1c4747a08da01b733580ee87f5c244d4c2d40a3c1c66c4912e2952c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298551, "uuid": "dbe58928-ab76-4913-a84b-f77c3abda35d", "value": "95C2E188178919E9D2F5C178476C176C1DA40BA6F809DC8578FCF7629D8E4793017ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298551, "uuid": "c9541b95-0c81-43be-b1be-da261a8e1d83", "value": "768:f2G214DFyosXqgvV9o1ndB08pJgGlzDpbuR1J6:f2GdDgosaaO1ndBVJuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624298551, "uuid": "e468330d-6f8f-486e-a893-24512822d531", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624298551, "uuid": "614051b0-597c-410f-be13-7e16fc2fb2f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624298551, "uuid": "2095c0cf-3ccc-4b09-b42d-d546c727cdd4", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ec999d-d2c6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624303617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303617, "uuid": "cf5e359a-2902-447b-8c5e-49e7538d1660", "comment": "Malware payload (Gozi)", "value": "f55038066f2928a55c4ae812db789db7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303617, "uuid": "d21eac63-ce15-453a-a02a-076491ed927e", "comment": "Malware payload (Gozi)", "value": "ef7d2dfe2e6cc6be192d145a55307f8aabc577f01ed7b62267de9bf2b5cee65a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303617, "uuid": "57879055-6099-4319-b83e-82242702d0a3", "comment": "Malware payload (Gozi)", "value": "9f8d7860f801e987ab5fa1255cf39c5fd6466c93", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303617, "uuid": "f57886cb-6929-43f0-b13c-aac5f37581b4", "comment": "Malware payload (Gozi)", "value": "e264dd9679711a235d715b23792261571ee53774927fbb65fcbd926c5e674da866fd4931fe8bfb50c7ef84d83416b3c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303617, "uuid": "1068f598-d179-460b-96e7-94fd82515990", "value": "FD647C017A889030D1F352760F24EB81476DB9665B718ADF3BEC2D8E1F7A4D29336762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303617, "uuid": "2fe9133e-5047-4605-998d-1b9e96780137", "value": "8199c7f6de79daeb94a04a3f31dfd4d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303617, "uuid": "12f09f92-1d17-4cb6-b150-34c1eab60638", "value": "6144:iwfyz7+Vg3teuh/2Yg9AXCeJBhqNgam/HGuF1Fanm:iw+7Agdeud2Yg9AXvBhq2am/N1FUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303617, "uuid": "d09d7312-b1ad-4656-8d53-6c317d15cc43", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303617, "uuid": "cc2f9683-b17b-4ed0-915a-5e65c566edc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303617, "uuid": "e3ee4fb8-dcab-4dcf-a1df-4dcaf15b45ca", "value": "lngCopy.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ece197-d2e8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624318223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624318223, "uuid": "57e992aa-1557-46be-bf41-cda3153a7e26", "comment": "Malware payload", "value": "22d9cae00205d10fdddde71ca75ebc02", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624318223, "uuid": "e82d35df-72b1-4740-8241-a58ecc8817d9", "comment": "Malware payload", "value": "f016bb4e883c001c82a4cf91745844f14b76fd015a2747c491badae79c2b0911", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624318223, "uuid": "d054c694-1f38-4bac-a2b3-37e914ad9788", "comment": "Malware payload", "value": "cdcc7e1199eb60425512a22db3e40f777eded7f7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624318223, "uuid": "b0e4103b-5813-4020-a1e2-f322722016f1", "comment": "Malware payload", "value": "12caf65c4d2d1ce3ac3ef5bcafe7ab37ab09c7b7bcade84da93d4aef28793eba21595eb7f9631a984123d7cd8af76870", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624318223, "uuid": "57e10e7a-67ed-4987-854b-f9ffc8d80eee", "value": "5F16F11279CACA36F97E4530A569CB7A14F97FE00BB188DB13D49A2E0E711C2417AF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624318223, "uuid": "163e8d35-f6b5-44f7-a079-cf0d8d070504", "value": "98304:iYplpAZmLpUUfcULGvEn5w+Dzg37XGfxAgJwkZDePpSpZfl:7zff5CEn5pS7X6SkZDeIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624318223, "uuid": "b2801a4d-8b35-4758-afa8-5979df4632c1", "value": 4058624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624318223, "uuid": "b4fce9b9-14b5-486f-9503-29c6954fe30d", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624318223, "uuid": "5b7881eb-64cc-4191-849e-1d09483faf90", "value": "22d9cae00205d10fdddde71ca75ebc02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbe74a4-d26f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624266377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266377, "uuid": "a4d1e797-05f8-44d7-9feb-54641ce4e6ee", "comment": "Malware payload (RedLineStealer)", "value": "c7d050afda523d484103b41110524c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266377, "uuid": "4b583b49-dd8a-4789-af00-548a21b1b909", "comment": "Malware payload (RedLineStealer)", "value": "f0aa9e2cd810d02afb47a4dee2f52d2b8e69f37d167d5a686fe654637cca78a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266377, "uuid": "6e9315be-0143-48e1-b14e-5a9c94ac7b75", "comment": "Malware payload (RedLineStealer)", "value": "76d7d840f5db3a8834b37e7059840dab7c399636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624266377, "uuid": "25e0f387-c6c0-4e3f-b45a-00d143ed7eaf", "comment": "Malware payload (RedLineStealer)", "value": "0762656e9816b61ea5fc94969c28645c1e6a6642f60449bb4b9b46ce74dfc026535b2bc0d3309c2655c1aad180f7070e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266377, "uuid": "89218d62-3bcd-45b5-88f6-8c5de8d7b246", "value": "0F84BE11F7A0C035F2F762F8567693A8A93E7AA16B3050CF12E51ADE5A347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266377, "uuid": "3ebe452d-7e81-4c38-a920-d1d9be28b3c3", "value": "123708792297e850a475b64837725c34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266377, "uuid": "365fe674-395f-4d61-87c5-9698766ea372", "value": "6144:3snGHYRsVFy/NJ3mTFgKbvmzC0Cobc6zTPiXxuG+j4W1ZKriuBz:EGHosVFy/NsFgK6Wybc6zTKXwGrklM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624266377, "uuid": "94826cff-0a14-4870-ad5c-7ac7b535c77e", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624266377, "uuid": "ea9a25d8-fd0d-4cfb-b0de-2a6f962fe144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624266377, "uuid": "3587f000-d764-401f-b9d9-31c86c2dd070", "value": "c7d050afda523d484103b41110524c26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bad063-d28d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624278921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278921, "uuid": "5d40bc66-5391-4351-9bc9-f1d1fd0afb7b", "comment": "Malware payload (Mirai)", "value": "a78fd65b407a8e11ba23907b5f2d16e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278921, "uuid": "98c89c80-b9e8-42cd-a0e8-b0ec956809c6", "comment": "Malware payload (Mirai)", "value": "f1669337b72824be7fbaa06946bcbfc4dbabf69896d1e7bdb2ccd6ab5418e8bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278921, "uuid": "339aed4a-7f27-47a5-bd18-55f36adbc343", "comment": "Malware payload (Mirai)", "value": "183233a37a3838563ef75dfc9d9ff3254a00fc84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278921, "uuid": "077068ee-1948-4dc9-b33e-1e68645a4803", "comment": "Malware payload (Mirai)", "value": "01ccb8420c6cea872a2c49cb7399d842f3e991b4e809eb91bfa5f837cb6f74bda70e525ff96eb6e49c2de4c6c0d83bd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278921, "uuid": "8c2f3db5-269c-4177-ae5c-ddd0b162e8fa", "value": "CCD2F9A2F902FD7DF41DF77FC5060416B0B1B2A642820B3267B3786BDD761A60972E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278921, "uuid": "b5d0761a-0884-4355-8dd2-0fa5559b3bc5", "value": "768:HZbOaoROIzGJb/JNFhsIV6S5i8bdAzsBr1:HZ6RShOIUS5i82zsBr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278921, "uuid": "66056f3a-28e1-4278-8c42-4340bc7274f6", "value": 30304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278921, "uuid": "5a04e9bd-a7f2-4b35-80bb-b4f9e944291a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278921, "uuid": "543a424d-9b20-43d8-90f6-25ba85038c61", "value": "a78fd65b407a8e11ba23907b5f2d16e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fece55c8-d2a0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624287447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287447, "uuid": "9222e688-f73f-4589-8c86-efb11d13259c", "comment": "Malware payload (Formbook)", "value": "8bf79df67900ff41d513883e29ae996b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287447, "uuid": "ed564d13-9b91-4a46-bf6f-401e1c242d6d", "comment": "Malware payload (Formbook)", "value": "f1d0b0bb1e438e5dfe53cda279dd4d1f07b18ac172ce39c4eb5fcfaf8ccedb89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287447, "uuid": "62cfd36f-4cbc-4e40-a42b-a62ff9298f4e", "comment": "Malware payload (Formbook)", "value": "361e91c6316dd869e99fe3133f13b55a4d2bc8e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624287447, "uuid": "a75d1481-709d-4f0c-83f9-e41757d79ac0", "comment": "Malware payload (Formbook)", "value": "00f779aaf02c433cc2a243e008a933e83671152b5bc28bc1d47a1404cd7ead556da52fd7723653ba62267d97d0731241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287447, "uuid": "d3d7bfa4-f602-40b7-9e48-3222610cd520", "value": "762412BD62D34D77D596CF302BBE6334E6BAA100125897C787A0CF7B68621C34E4A671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287447, "uuid": "7342a985-5fc3-4449-ad48-2c97b9f235a4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287447, "uuid": "d32e4334-d1d7-4df4-91ae-8a96b54918bf", "value": "6144:QBlL/3h2fFPzcfzBFR2EHHbyC+kib/5GX:iVh4QfvUEH7qb/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624287447, "uuid": "c22c3f83-ce85-4118-8186-a7cfce330d95", "value": 225660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624287447, "uuid": "346d7d0a-d9d4-4833-8c6c-233403e15a1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624287447, "uuid": "a588adda-75d0-473f-959c-9d0589828661", "value": "kdhfue77324.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8599414b-d2c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624303135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303135, "uuid": "c35ca5f9-69d8-45f3-b321-e8d48f5bd28f", "comment": "Malware payload", "value": "2778650cf580fcab0d721d41ead80517", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303135, "uuid": "283179c3-10bd-42b3-a63d-7c0369a71e8a", "comment": "Malware payload", "value": "f2040360f616328b604f250435c203f28ed71cae425e730f1d1106dc4e00b1e1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303135, "uuid": "9b2b0f8b-faaa-4da8-96f5-97e59b2169d8", "comment": "Malware payload", "value": "9464966e79017b77400fd5ea0dd5f1a324cc61bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624303135, "uuid": "2f7996ea-9045-4b6d-88fe-cfeaa40335f3", "comment": "Malware payload", "value": "0225772542351e2377d1282bb1bddcc5d6d2514afbbbe63a57b84abef0131f9654dcea57bf05c2fad3464921bc6f3c00", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303135, "uuid": "974d9904-4d94-4005-bd49-e0e6feea736f", "value": "2833C118F102DC60EE1FADB995F960A036BB06F4F3905CA6B880E65D59B105D8F377CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303135, "uuid": "161ccbf9-e70b-4e8b-a2f3-694f95afaf9c", "value": "1536:/mlHyQIOf7SieU6ZDvxjxcpAr/USvhWyczsIfoW8:/sHyWSiebvxju4/UchWyczJfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624303135, "uuid": "b6cd4f91-bbb5-467c-8f43-271bb9d78a01", "value": 51190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624303135, "uuid": "03b7519c-e84a-4a7f-bb13-d409189e006f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624303135, "uuid": "0508c3ee-0d68-407f-b6b1-4077da2c4132", "value": "dictate 06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2ea825-d2e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624315202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315202, "uuid": "ca2fe074-e610-486f-8d06-54b43e808aa0", "comment": "Malware payload", "value": "7cd4f725ebbd79662e146ccdc7414aa0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315202, "uuid": "c6f4eb5d-df82-4c7f-9029-1c1d9152d3ab", "comment": "Malware payload", "value": "f2ce67551e79c867147ccf0b0643afb95a2578b79c07aa6f75eddb821bbeae5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315202, "uuid": "1fcfc263-1694-414c-8d78-f6378b3f54f4", "comment": "Malware payload", "value": "f84852c3bd0a4f8d867360e43236cf083fb15cdb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624315202, "uuid": "a946db0b-74de-483a-a49a-13de06dd2077", "comment": "Malware payload", "value": "4fcda0d7bdffed1c236db2a6cb5f76de5cf1fecdd7f3132ff583d04d9f17c6943131c9802639df50ef8285a0cc7da9f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315202, "uuid": "a77dc7ea-6f02-4892-8da3-013369639578", "value": "28B2C740E78F51F7FD4B5471119BB63F6A204B06C20CDFB2E784AF52D17A7A2A02A685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315202, "uuid": "349697a5-a29d-4b20-9e03-1e0b3723c03d", "value": "384:UbxkZHV/LDJo27FvIvTW06nh0hBrAgQI8vBTFWwc5VhCkpGPH:MuZPMpj8pUt5VhCkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624315202, "uuid": "84ecf05f-2dbd-4f59-b0dd-02bedb6c1aec", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624315202, "uuid": "ffc4e49f-e9b1-4d03-8bf9-0a34a356229d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624315202, "uuid": "cbf47b12-c754-4b05-931d-3fc0db6c3014", "value": "B86mOjbu5g4w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebb2b69-d2a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624288091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288091, "uuid": "a1df970c-b8d4-4d17-9114-073ad3e261fc", "comment": "Malware payload (Formbook)", "value": "e46a53f767a1f8330dc7c3121fab6b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288091, "uuid": "5d6ce75d-10f6-4e3d-8219-2e893a4055ca", "comment": "Malware payload (Formbook)", "value": "f2dbb6d22033306507ed1ed49781edaa558374b79ac871276cdb33b343c8f7bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288091, "uuid": "ae7d122a-9401-4833-916a-a430e617c12d", "comment": "Malware payload (Formbook)", "value": "8e0fdac45a302dbe5b299270faee3d2d2fd3263e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624288091, "uuid": "b0bff14f-adee-4b2c-a99f-290abf876cce", "comment": "Malware payload (Formbook)", "value": "ffeed5683989d08fa9645e1f2a664a16445cd6638aed758b1a9609122e4deab91e143d500a325fc9e89c1b2780c2cf71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288091, "uuid": "7edc4b3d-a243-4950-b117-4b10b4865e04", "value": "6B25BE29F7917FE6C1590F3B851B0E9483F081377232F79B6DE15AE42602B994A5F283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288091, "uuid": "21756e54-5ba7-453c-bedd-dad8e5f3cf9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288091, "uuid": "a3cfc0ea-2954-4d4e-beac-97b49fda54f6", "value": "24576:nJ4HOe0t4oBNHRVIampamTec3G2qskTLoyL:n2Oe0CoBNHRVIampamTec3G2qskTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624288091, "uuid": "1513b670-e64a-4410-8610-f325b636fadf", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624288091, "uuid": "7ed86b51-8eb3-4752-9238-83ec35ac36b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624288091, "uuid": "1278980b-7b6a-4499-9699-e286637b8ab0", "value": "929394020293276393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72c8f5e-d231-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624239707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239707, "uuid": "ae14ebc5-2f20-46f5-9560-00588ac85e14", "comment": "Malware payload (Mirai)", "value": "49da977c8ebb7d594b7fbc1583e82967", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239707, "uuid": "19b23249-994c-4821-9736-33608d483b56", "comment": "Malware payload (Mirai)", "value": "f33a608b729be4a9336d55fe736261e309ef30b42836d90eb67f5ee4f86ce568", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239707, "uuid": "979168f4-7433-47f5-9dd2-38e66b560072", "comment": "Malware payload (Mirai)", "value": "baf365bab82a917f4c16dca4adf4b8d8c2fae043", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624239707, "uuid": "9109b192-cf2f-4ef7-9717-e7acd20a316e", "comment": "Malware payload (Mirai)", "value": "14e63c02d5d2f091eb4851d928b4fd8f2b65eeee15e659c08e6ccc4582487c773ad422fd78f595d8729d622c8bde6407", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239707, "uuid": "386d0127-d8db-42ab-9c94-51fe478e6e52", "value": "3BE35A93BA04EFA7F90E977608D30721B730FBA50E532622A61778A69D371D07827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239707, "uuid": "09582dc9-f129-4217-a83c-e115042d4ee2", "value": "3072:JiLHORlsObN4m99JOJRvyloziMaEN2hiNGWza4mL6VyuYZ4ylB:JmHIxr9zOTylEtVkKNmL6VyuYZ4ylB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624239707, "uuid": "566d7260-d9b1-4737-9307-d1b7b22db41a", "value": 148847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624239707, "uuid": "b7d8c7e0-417e-457b-bb56-a0454fb1db42", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624239707, "uuid": "67ffdfc7-ae80-4106-a031-d635dca62f4a", "value": "49da977c8ebb7d594b7fbc1583e82967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84d5d8d-d25d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624258553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258553, "uuid": "0d4437df-45d1-48ed-a74b-df01364e746c", "comment": "Malware payload (RedLineStealer)", "value": "c13e121d99ed9cd77e3eca5389e68e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258553, "uuid": "46fd8a52-eb1b-47c6-b77d-7a2f3fe78a77", "comment": "Malware payload (RedLineStealer)", "value": "f52969508d65c46a912878b8c95f60073f7cceec89c22157c413302c71e9b6a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258553, "uuid": "7b2903bc-1718-43a4-b5e6-2ef6b5e30a97", "comment": "Malware payload (RedLineStealer)", "value": "69ad8d1d2ba9e35762836d2da383e865969ebef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258553, "uuid": "4d1c8196-6e8b-4f7f-ac03-c6b105c05cb4", "comment": "Malware payload (RedLineStealer)", "value": "17999db13ae58177b74faaded7fb46817e776efafc30043726fb698fbf466150e33a57c2a438dad4acad21505a5ef05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258553, "uuid": "c4978e1c-e844-4275-b375-0ebe866b8c9f", "value": "A9849E11F7A1C035F2F762F44A7A93B8A93D7AA15B2450CF12E52ADE5A347E0AC31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258553, "uuid": "437a922c-7a5c-4096-a7c0-990903d42bb8", "value": "621d175e940c3f2ca7217a398b3c22a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258553, "uuid": "3db54f83-cc84-4ff6-9f39-c5135cccf555", "value": "12288:U2ZkoPiJi4tUK83PGa4POWeNXrjG0YbtVyl:UDoPiJUDGa4HeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258553, "uuid": "f31c632c-aad0-47fa-b6a9-08686333dbe5", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258553, "uuid": "6e01d987-d33a-4bcf-8aa5-044ca1e9d067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258553, "uuid": "d8e5d4fd-cdc0-4128-b5dd-d7e2fef95695", "value": "c13e121d99ed9cd77e3eca5389e68e37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5057d5-d28d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624278903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278903, "uuid": "3f9a684c-01db-48ea-b198-e4b48ed78f2f", "comment": "Malware payload", "value": "f7279eafc523374fc2293add18fe615f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278903, "uuid": "c629d8df-dc2d-45bf-b39e-2d0e41d7c1b9", "comment": "Malware payload", "value": "f69126bae20b51657b2ef5103daa1a8387cca4caad3e8ebaf663fd7826da2168", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278903, "uuid": "2dcf126b-0b14-43ec-b82d-c429ff97648a", "comment": "Malware payload", "value": "7852d8a2464d400012abb299baccbdb82a115319", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624278903, "uuid": "0b1e62d8-9225-4271-8a78-6a76253d95bf", "comment": "Malware payload", "value": "71af58df10434c1ba17075660a43d4b6fc6f6b27aedb0bbf97126123c25ef2ec63f5f86a28a292915b3a2484078d921c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278903, "uuid": "774e0cda-a4ce-4a71-9234-f0bbc9c58a64", "value": "B6E24B35BE62186FC4C85E7A55E74725B6F6434F38F88A3B3C220E9CBF04A447253669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278903, "uuid": "05d26ffb-ad7d-4797-a8de-f35a31693f62", "value": "384:OGHQmVI7tBJ3aXoOCZM4P8IFU+pMqdY9HlMaGACqqEjDw:OwQmVI7l33FNO+uKaGACqqEjDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624278903, "uuid": "61a43c9d-2db5-48df-885d-161db312f81d", "value": 32920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624278903, "uuid": "c2901d23-fec8-4fd3-9b7f-0255bf0ea540", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624278903, "uuid": "3412fedf-c9f4-4b98-8932-0d7e0696ecb4", "value": "f7279eafc523374fc2293add18fe615f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ff9ead-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624259186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259186, "uuid": "ce60ef84-c6f1-4fdb-829c-7f51a27ad08a", "comment": "Malware payload (Loki)", "value": "ba341f148a83512be9c090723be1a8dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259186, "uuid": "d85c22a7-44b2-471f-bcb5-999be0cf4cc4", "comment": "Malware payload (Loki)", "value": "f6c76a8e4a2f75a80da9e35227d25f05356cee5d186f5177e87f0f4a1b911b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259186, "uuid": "8d22397c-d2c3-4f44-b1cb-9abd3435d3a1", "comment": "Malware payload (Loki)", "value": "861896361a84cbe2a0e84b2b0b6331d1d344bf34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259186, "uuid": "37dbcc14-1be1-43a4-a006-9d056d5020a1", "comment": "Malware payload (Loki)", "value": "1c2c15a9bc6965844c37bb2462cf24ddeccac8925368288d321eee2ae70d47a571f78c1b189dddacf242b31778b4811e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259186, "uuid": "e6d2d65c-abb9-45c8-88f8-dc1eab982f7e", "value": "C0E4AE2039EF911DF5779E781AE436E29A7FBE637B07D95C24D4234A87238428F40939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259186, "uuid": "2ead5708-02d9-454d-8b99-2fff9644b713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259186, "uuid": "86748deb-9b47-463c-955a-86a70b4dd955", "value": "12288:9cOWOlmWFHmsZeHDankVkSBfv5NlYyXYSNRJ990iFqw3uHhU:9ZBVHaHD6kB5NlYyXYSNRJ9CiFqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259186, "uuid": "72ef70ef-5128-45ce-8497-a06ccad26736", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259186, "uuid": "b7ffa45e-69d1-4230-82c9-eaa45c86e708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259186, "uuid": "71f22c3f-b92a-400d-845f-7ee8b84d13c3", "value": "pdf.zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca489fc7-d25c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624258153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258153, "uuid": "8a825334-e331-4cc3-8987-056b72cf67c2", "comment": "Malware payload", "value": "55ba21a450bee3fc9954d30f5f167f4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258153, "uuid": "d9f2d3a0-5299-4e94-8091-a950e5fdcf20", "comment": "Malware payload", "value": "f7f16b5de4c2a0406ea8003b3f66607feebcc712d878d55960f592ab84ec542d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258153, "uuid": "282d3a0a-6a91-4624-9997-a9013fa02b9b", "comment": "Malware payload", "value": "bfa27fadf605148276ddd974eba3a2c3ae08511a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258153, "uuid": "a353e653-aeb5-42c7-b631-3bd2801b280f", "comment": "Malware payload", "value": "07d9e679e122cb7591d8457e04abe0a4f637a031e12811a5c9f3b0aacfaa03d9aeb18db471968661e7e061a41933c9c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258153, "uuid": "3085435c-b939-40ef-b321-603722323546", "value": "E4F423461BEF6CF5C64461B5FB8F150E732C01962E1A8B7349AA3CC43660FA2ACD51CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258153, "uuid": "1ff9d64c-b353-491c-9ba5-85a6f5f6d4f0", "value": "a3ccd95ee9050e5b7d3c82f6dcef8a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258153, "uuid": "bad86d25-1286-4587-a438-4cd3dc2702ae", "value": "12288:CZJTml8GgSq2n2Etc3k6JoiCjwsO3CnJmdRpMrXLy19QmfdWR9gXbp3+wCt0RKgX:CZJ3GgatcbdCjVOSnJmd7X19Ncvg13+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258153, "uuid": "755a1bfe-14e8-44dd-861d-8e643558e768", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258153, "uuid": "bc729f62-3f61-4f82-b1dc-bed287f34821", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258153, "uuid": "e3e13493-ca67-4231-9883-2f36ab3aa843", "value": "55ba21a450bee3fc9954d30f5f167f4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612e33b3-d25f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624259265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259265, "uuid": "4741fbe7-139d-4e1f-831f-2dca76a80216", "comment": "Malware payload (RedLineStealer)", "value": "67fa6a4672d5172941866bc4fc79c695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259265, "uuid": "ba259ff9-3d45-434b-a792-586d054e9707", "comment": "Malware payload (RedLineStealer)", "value": "f84d6070c612dcd27962e45d37cebe1a2f4065c8d8187987e357208b2367dd15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259265, "uuid": "d9ef82e5-7f98-46ce-96a4-8e2bd028a856", "comment": "Malware payload (RedLineStealer)", "value": "2218073781d5b49c927c94f961f7a1e0d553d72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624259265, "uuid": "e34fb6c0-3ab8-472e-a585-c49c304fab03", "comment": "Malware payload (RedLineStealer)", "value": "517190f856e2f9f58b984ddcc5ae576872370b599e498d86b056c4628c7bb833d4d5ecb320a59da41bb16b9c166ad05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259265, "uuid": "87a8a7f3-4b9f-4836-a7fb-66da7eacede1", "value": "60E4F110B692C034F1F622F8557AD37CA43D3AB19B6861CB62E51AEE5B347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259265, "uuid": "6acd34c4-de96-4ab4-b11d-6e6ff1fd0905", "value": "cef982a39394466fe74a88f9214df2fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259265, "uuid": "f3b1f861-dd30-492f-997b-67e5dd7ef7f3", "value": "12288:7czsEJmGrrn1ySMlPBnm+Zi54smQUyDYmAJmN3rS/SQgVpnjLHSWAtyRqL+2lu:yTJmGrrWfmqLdyy4G/1CpnjLDAtr6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624259265, "uuid": "477e39c8-f870-45f2-a7e0-a3e884921fac", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624259265, "uuid": "7bf9f427-4536-43a2-acb6-f6a5d0d8c5c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624259265, "uuid": "ec42bee0-1e7b-4c50-818a-9810c5d9bea5", "value": "67fa6a4672d5172941866bc4fc79c695.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c3a1ef-d2c4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624302699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302699, "uuid": "e0446153-a79c-4aa4-b2f5-6422aa29d0f2", "comment": "Malware payload (Mirai)", "value": "12bc8fb93a598fdcf356e6757d5568ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302699, "uuid": "38b331c8-41e8-4e03-834b-44d4fc1d8ef7", "comment": "Malware payload (Mirai)", "value": "f863e26f4a3345d72f83efabd276a55619c1f232410f5cfd0be3dc0e876f1bd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302699, "uuid": "571890d9-9103-4886-a00d-aded79d4e3dd", "comment": "Malware payload (Mirai)", "value": "d0e68a72e8cbae9fb332da4e9a0a1b1aa8857179", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302699, "uuid": "0a6dcf01-4b69-4779-b23c-a9db3278eea5", "comment": "Malware payload (Mirai)", "value": "c5c85b2900335f1c9fa9c11601b1a617cb26b7580ab60b3eb1710bbe1659bc992afa010bd1ca68d6b49e6e6994585abe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302699, "uuid": "782d770d-6dae-448d-96e6-7f8569ff5211", "value": "B543021DF5FE3C8BC74D2CF6F48D25198D41FB68BED943587E144AB919A1C4E2A0A035", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302699, "uuid": "2358505d-69c0-482b-91ec-dd022b892edb", "value": "1536:FBHuFYP9q/SgQ+Yxj1MAe4WnS4maa5uo3gG:Flu+sqgOpmpnzmaa5uowG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302699, "uuid": "a1d01a15-407c-4449-a7fd-8d72fffcd58e", "value": 55384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302699, "uuid": "458c9ca4-820a-4735-a954-6adc755da81c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302699, "uuid": "f8cf89fa-12d1-4f9a-a730-ed15705dcde4", "value": "12bc8fb93a598fdcf356e6757d5568ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0d6af6-d233-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624240309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240309, "uuid": "9bdd7e97-72dc-47af-be9e-67f9b255ee30", "comment": "Malware payload (Gafgyt)", "value": "ec369acee990fbef39a1f8da5a874c4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240309, "uuid": "75b55aeb-b3fd-4f13-b947-09d22ad0c919", "comment": "Malware payload (Gafgyt)", "value": "fab6237ff0e7e54a229ffe5fb978c5dae2301fa6aa1fcb3aa65b4abbb924750b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240309, "uuid": "3deecfbf-ddf4-47af-b23a-cadd68ae70cb", "comment": "Malware payload (Gafgyt)", "value": "19a0df6e3a1e4a11f7d63516aa30ae92a375456a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624240309, "uuid": "6f48001c-c7ab-4c6a-b5cc-fc1c4af6cc36", "comment": "Malware payload (Gafgyt)", "value": "63052e8c4c4a58cdff172cd2a5a833d90f70652c7084848cd5642b11884a79ee667ba3b15dc1eca8c25cb1a89ff726c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240309, "uuid": "f611016e-71ea-4935-8bd6-3e298f156430", "value": "5203E163D189C5A9D0672570B4AE7B3E5D74232C898807A2AECC365F8855B0D3E56BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240309, "uuid": "0f1a7b71-1bc5-45bd-9553-8b43aa84753c", "value": "768:ZwTv2xHfR7Bn7kURL51T+yPgt5G6YidlSnbcuyD7UryqL8OAfnBY1KkQ6E:qTv2xHtJ7kKUZ2wlSnouy8mqLMn4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624240309, "uuid": "29413b20-4c31-4161-a771-70e80b7d0f79", "value": 38704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624240309, "uuid": "97bffa20-e523-46a9-a55c-3de84e245e32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624240309, "uuid": "910136d8-3b7b-47b7-a651-0d11b6c59ba8", "value": "ec369acee990fbef39a1f8da5a874c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d8d6b4-d25c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624258191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258191, "uuid": "486256e4-5657-40bd-891a-9568a9d5655d", "comment": "Malware payload (Loki)", "value": "1b530dc1394b4a84d8f68c76f89eb08d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258191, "uuid": "20136d74-2825-457b-aac8-058f33d50206", "comment": "Malware payload (Loki)", "value": "fab74e6e08763b9bdb907253b587b607d73742cf989cd12332ed0b92abce7e55", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258191, "uuid": "d16437ab-11d4-4902-9856-6720f251b7f8", "comment": "Malware payload (Loki)", "value": "c47ab452385aecd0d9582081a44fc446298183ed", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258191, "uuid": "953f6bc4-0bda-451d-8542-9b6c240376ad", "comment": "Malware payload (Loki)", "value": "4275da9c7e380254a0115cce23acb85ba1e850d2234afcbac82505ff4c941d639a71e821ce9b4d013d14433872835d16", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258191, "uuid": "210aa095-c48b-4db8-b191-2dd0029adb58", "value": "01553347EBD4CF52C10BFA35579A86665AF9CD2039C0CA5F3BCDB350207A7A16A4234E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258191, "uuid": "ebf3d583-8ec6-4c9c-bb64-92b6fac750c5", "value": "24576:3rScSjlAhqiaP0L/u52Mc29I8CvRqXfvTB1xRGjlnyZ48+v4/1Nk6ix1:qjlAMiaP0jDMRmvRugjlnL8U4/vk6ix1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258191, "uuid": "33c879b6-50c3-4b22-8556-f86af7423378", "value": 1346048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258191, "uuid": "0fd24954-652a-411d-807d-439c2355bbc8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258191, "uuid": "17c6ee46-04ab-4efe-9b72-7b8668aa8e7c", "value": "SWIFT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ff2d1c-d25e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624258896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258896, "uuid": "0bc5acf0-e654-4e8a-8ec6-3b73bf6574e6", "comment": "Malware payload", "value": "3f51026069dac5d3e1b8c085ba90a0b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258896, "uuid": "cd65d135-facb-44bf-a216-b6ef7ac45c6f", "comment": "Malware payload", "value": "fbf5bfca398911605785389a91147f5ef8e188fe0778cb2f1808ab0f0d415c88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258896, "uuid": "8e250d18-2743-41a7-ad63-9587f397b928", "comment": "Malware payload", "value": "47346fe7178785b13c1455f163cb5bcd3b66909a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624258896, "uuid": "e8b92f32-9a3e-4cb8-8e8e-fbef2205266e", "comment": "Malware payload", "value": "153bbfbdc61c31a47298e63cedc94878cb32b31bf2093887494b1d0de9753dfa84c31e3fb3d2b87d4a1e6101492be30e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258896, "uuid": "e889378e-cd6c-4130-8958-2b5fdd0463c0", "value": "D866332074C9CCF9C0592631C76636FAD5FA62015E758C13B3AA0EAE067FA41D17A39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258896, "uuid": "16279389-9b8e-4128-8c1e-baf20eccd223", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258896, "uuid": "5994b0de-ed75-4b40-aefd-cac6c3efdf33", "value": "196608:h1OnKz97gDIJoBQ1Cg9xtQqLSOr+HUandAC2ajCP:bOKzGQVtQqua+hdACNCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624258896, "uuid": "28d5eb46-3452-47f5-8fb6-dbb5d000a686", "value": 6576998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624258896, "uuid": "fbdd8291-629f-4611-8aad-eae811429771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624258896, "uuid": "eae8d0ba-d9d1-410b-8b62-ed275ac3a7d3", "value": "3f51026069dac5d3e1b8c085ba90a0b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e621cb5a-d251-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624253476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253476, "uuid": "3f42c8a6-e8bd-4245-959a-c80465e8d11b", "comment": "Malware payload (NanoCore)", "value": "27bd034c36964c455e2b2ad6b264561f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253476, "uuid": "b8ac378f-adde-4740-9843-5e4a68d47bae", "comment": "Malware payload (NanoCore)", "value": "fccb7bf8b49c1ddecb6697f61320cd762be77122786bfefe1c879b9529cb4560", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253476, "uuid": "6a1adc1d-611d-4a13-bdb4-100c91f2a90b", "comment": "Malware payload (NanoCore)", "value": "e516fa05c9aefab3d4cf43208d367817c383e6d0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624253476, "uuid": "b066a5fe-8f6b-4abc-95b0-941650d333be", "comment": "Malware payload (NanoCore)", "value": "34857eb34cdd7db22248063fe3f1eef173084492b0a8da77a23466754117cb4ee4e9950390084070a3c2cf2040366f98", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253476, "uuid": "6e3ba367-2c1f-4772-9aed-4526026890dc", "value": "F7C423220B5F44F4CEC7E0F9F2769D9A8C78791BA2572EFA0561472913EFC4168E1887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253476, "uuid": "6b2acffb-86cb-42ad-8cb3-b27ba2e95daa", "value": "12288:3OQpynPbbCfPQsmOnqGBsSKvrZdmYSln8vaOaPklKsDt:hG2Bnd2xPKlGaPmZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624253476, "uuid": "c71cce86-11ab-4a28-b3f5-a55dce2d51d0", "value": 593358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624253476, "uuid": "bec1e1ff-1745-4cef-ad81-238e8ebfaf01", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624253476, "uuid": "e463898e-0dc4-4911-9c1f-8c6249cefa7d", "value": "27bd034c36964c455e2b2ad6b264561f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f396957c-d255-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624255216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255216, "uuid": "6be4064b-a2bc-4c82-82d1-d0ca1d49eb58", "comment": "Malware payload (AgentTesla)", "value": "3e14fb96bb24da91547ec8f4117163e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255216, "uuid": "177481b2-115f-4efa-b4f1-87b54dd0ce46", "comment": "Malware payload (AgentTesla)", "value": "fde3831e1ec5530bf225546dd377c333c5394067bf52ba992ef3a8cdb1048e23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255216, "uuid": "71669457-2561-4d37-a6c1-f0ae15791aa1", "comment": "Malware payload (AgentTesla)", "value": "b3c9f7ac05b7e4f99bdcaebccb2debdf7e2972c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624255216, "uuid": "7fbe2a4f-f5b8-44f4-a8d3-f6bbb04055b8", "comment": "Malware payload (AgentTesla)", "value": "97a8b78339345208572d548b0d09707efaa9c3e4d2fcbd992c55b0205c86b07e3646dfe912884c3d677a04c680b4ca82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255216, "uuid": "048aa97f-1a35-42d9-a2c5-08ddcab66998", "value": "92D423DC86BEC89DA994F49F082A53C7C3EB46E0A8F55F68D20071B1F6D8E2E574452C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255216, "uuid": "66aa7285-d3c4-4711-8100-97ebdece5f02", "value": "12288:x1UEXe3CY5U+V+PVdQLgmZsicu3zvuKexZbuu28p4PNj7lSo/s4f3gPMKKg/Lnil:f+NafUiSjKjbuu28p4h7kyfwPqwLnF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624255216, "uuid": "21dc7452-aa34-4a7b-ae27-742b8022452a", "value": 652890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624255216, "uuid": "8837aed9-ac78-4783-bbc3-2e9261abc2cd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624255216, "uuid": "c19968d7-f4ce-4126-8e2a-a06598307d48", "value": "purchase items.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daf5a58-d2c4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624302692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302692, "uuid": "77fb8dbd-1038-4544-9eb7-8fcf8789a119", "comment": "Malware payload", "value": "4a8a98555885f0700e752e217e2bbda5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302692, "uuid": "0f0cf1e9-34a4-44e9-aa6b-40c2a58a46e5", "comment": "Malware payload", "value": "fe699aba9be69378c122860e42e072be556038aa2b5aa0236e2c2065627aad80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302692, "uuid": "a99ffb71-c666-4784-a099-6fe5fcd4a64a", "comment": "Malware payload", "value": "c2ebb94bb3927c39e3cad60604096ca4b29b2ea4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624302692, "uuid": "aafa764d-4e07-403e-ba08-1f1a5dfca6e2", "comment": "Malware payload", "value": "9cb03504c4f66a9ffef444e37aec23b87bec5a4238aaad61ea7d9dc774a7b2586adbec1078edda7c7a04d50a66489105", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302692, "uuid": "9b28d82f-d541-43d5-b0f5-eb1b8c25c185", "value": "3753026C927B7C09DE8B18BB81B565649BF699D833DE4B88B7104CCAE6384D730C85F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302692, "uuid": "24552ce1-87dc-4af7-94d8-e68c4b580bfe", "value": "1536:8DqnPFNwqXOL5t1lzy4oeZCJCdHUaGXsgpWuu2cA83qw:8DqPFnXMg4oZPsmcf3qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624302692, "uuid": "56d3118b-20fc-4b98-9e2f-3f52f8044525", "value": 66000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624302692, "uuid": "b9c5ef0e-f639-42a0-9fa7-4c4bf759f15a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624302692, "uuid": "e05b2039-3013-4eac-93bd-cd7fb6f3ce5a", "value": "4a8a98555885f0700e752e217e2bbda5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }