{ "Event": { "published": true, "date": "2021-11-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-24", "timestamp": 1637798581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "13e8ff82-8119-4a47-a345-004ce931020b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713ca100-4cc4-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637716713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637716713, "uuid": "4a3f07db-492e-4cf0-b6f0-7487e1a71024", "comment": "Malware payload (ArkeiStealer)", "value": "783ecbd8fa6042d2b11ab2fcaf471570", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637716713, "uuid": "ad893f2a-94e3-4a2d-83dc-9b1efb79c306", "comment": "Malware payload (ArkeiStealer)", "value": "00a99c2edfa36675109435795abb0fd3056bd007c66d76c40983d2de43c6f5ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637716713, "uuid": "22372e3e-270f-485f-beb5-9a5f75e06587", "comment": "Malware payload (ArkeiStealer)", "value": "1ce5e1da6f96b95e0f0a6b819123de76afcc1b78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637716713, "uuid": "095bfa11-e099-484c-903d-c9d69dc6fcd5", "comment": "Malware payload (ArkeiStealer)", "value": "29ffbec8d19604551599d0b10e32aba41aa31eb1dda2e426b6c7dc19266365ff283682e59e76f74695ce515664355ea4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637716713, "uuid": "0b5f8180-6d67-4260-9141-d7e0d4b313f5", "value": "T198F4F110AB90C038F5B362F84675A269B53E7EA1677858CF12E52BFE4A349D1EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637716713, "uuid": "b9c176b6-e06e-461e-b2dc-f849b15786de", "value": "9aeb2463a45e44e4b568bf1d36aa5947", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637716713, "uuid": "fe21ccbe-1814-4003-993e-165e55e07eb2", "value": "24576:a2oQXD9Ci57/k6/5fcvyHmFAFbtKTAPBFtE9psrB:qQXD9CGV/5fcvUmqD5F+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637716713, "uuid": "e8678ecf-c0db-43c6-aefe-fca2327c59ec", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637716713, "uuid": "02f9c4c7-e2a4-4796-9eaf-3ffd050d9f56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637716713, "uuid": "349ba862-9d25-44d8-aaa5-ce0f10d39398", "value": "783ecbd8fa6042d2b11ab2fcaf471570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce393eb-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637772514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772514, "uuid": "2b70bc4c-eac6-40b1-b035-dded5dfe5fed", "comment": "Malware payload (Dridex)", "value": "edade5d8daa62a2ad259855fb0d66e61", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772514, "uuid": "06522351-a27e-43dc-9bae-d994e49edbb6", "comment": "Malware payload (Dridex)", "value": "00af65b613ab193d31ac3c5fbb575e4368de7a0d119caf66a5d4536ad127aec0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772514, "uuid": "e385871a-aafa-4259-8361-e5a60874de89", "comment": "Malware payload (Dridex)", "value": "e65e871312d92aa7f72f848200e03d75c9657646", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772514, "uuid": "19481b98-e241-49f3-8bf2-0de48bafb573", "comment": "Malware payload (Dridex)", "value": "74036209163b9bff306496313e5efe4c2517989a4dfec9bc204fa8dff53201c48e82326b04f22aebbf293b5129434d5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772514, "uuid": "4ca6f09d-3926-4015-8f0d-83a724cbaabb", "value": "T1E3F47C67440FD860F6C58A3977BC6885ED85E2628F123FBAB9422C2563352BCD5B3317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772514, "uuid": "ca15ec6e-66ad-45fd-8e53-50db67d12164", "value": "3408863a87d01409eccbe58d6d3e764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772514, "uuid": "bfd1398b-bbda-482e-989e-d56e92d3c402", "value": "6144:UmHn0ZwiaiIiu4KiU0OiaiOw8i4isCAiKeoiyj3o10Yxc7Ijse4WjPPMOnnnCi1m:VQRDlh/tRVPT1rTjybATge4W70Onp1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772514, "uuid": "1dbd674c-8461-4702-b562-fca13e460736", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772514, "uuid": "91e2da09-41dc-4036-a857-c40d485ebf55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772514, "uuid": "cfbd7b96-1c35-49d1-af1b-db57faf938ea", "value": "SecuriteInfo.com.Variant.Fragtor.44159.27519.628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3055ab78-4d26-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637758695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758695, "uuid": "f3ebe31b-b892-4aa4-aaaf-2d0a9da65537", "comment": "Malware payload (Dridex)", "value": "b3df42ed5297d71449ac5b76c1ab3537", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758695, "uuid": "e7a13f8b-b89c-48b5-92cd-a6a7e7f4b81d", "comment": "Malware payload (Dridex)", "value": "010d419392db7c0e775bf91c22d39af7a609c465be074b7f1a0869c699514855", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758695, "uuid": "e070a84e-5a26-4b02-8cdb-e2ee89382b57", "comment": "Malware payload (Dridex)", "value": "704a829e4c11727c9028615e9d92197985217d90", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758695, "uuid": "4d2a6457-8e09-4503-99c8-f29e1820138c", "comment": "Malware payload (Dridex)", "value": "00dee32f87fb68aa2ce74b94d70615684dda5861aa7acbee10d9c0cac026f2237341eaee0a93ff9a4eee3bc1cef68a0b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758695, "uuid": "6dc33dd1-56d4-41bf-a4c0-a70c0c6c1fcf", "value": "T10883020FA123788CC526057C00DF55A67815871B7AABBD6B302120705DF63FBDFAEAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758695, "uuid": "c1bc74ab-cca1-41c5-ad24-fd08426de176", "value": "1536:UWCP2CET+S+agP7nA9u9DE230QFc6Dd+Fq7eZg9VgdwZg:V7T1k7TA1QFzDbqgTgd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758695, "uuid": "100c8b3e-e73b-4c53-b029-265c0118d3d6", "value": 84385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758695, "uuid": "0e0002ea-aa3e-4de3-a631-b0eaceac184f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758695, "uuid": "8fdd49ec-1ac3-4250-8ee9-cc9a17d3f2bb", "value": "Netflix coupon_18402567.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd55980-4d2e-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1637762365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762365, "uuid": "6e77fb58-9ba8-459f-9329-b54071e1d649", "comment": "Malware payload (SilentBuilder)", "value": "9ef998d769f9c15dfa2f12d730105967", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762365, "uuid": "86335dd0-27f4-4929-85e2-e19a430ccdb4", "comment": "Malware payload (SilentBuilder)", "value": "0187306e6db11b5cba2a50c88dd15c5b2ceb2593976a99a642052375c8e7bf06", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762365, "uuid": "e91513a3-94ac-4852-9da0-d2b245b857df", "comment": "Malware payload (SilentBuilder)", "value": "7853f48ac6afa6fd22c9bede90c015151f859145", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762365, "uuid": "2f9ff859-c601-4074-8192-bc9e516e2967", "comment": "Malware payload (SilentBuilder)", "value": "d138eb9caa69e57e08d2b18eaa67bfc3fe138d7b0100d3b8b182ea5ed5c29746081ba5afe8888e928d6222b1769baf6a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762365, "uuid": "e8e4ee2f-2ccf-4bb9-bc40-56bd3226e62d", "value": "T16A34E146796CC8DEFA57833148D75BAA6333DC204FD71A876AC9722C6FB4DB47912006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762365, "uuid": "10d869a8-1da2-480c-b320-16d12c2fe445", "value": "6144:MKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgwcfFw6lxFT7kFWqOSMQ6HujLmH98DUz:tFrlxFTMrvbiFd8DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762365, "uuid": "2f4f9323-2109-4256-8f2a-e30af9021832", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762365, "uuid": "7d129f82-cffd-434c-9d22-a6589451c311", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762365, "uuid": "97dbc49b-d694-4580-af67-0fdc2b262150", "value": "chase.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbe9b69-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637779199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779199, "uuid": "5f69e869-1492-4925-b106-5c1194a61773", "comment": "Malware payload (ArkeiStealer)", "value": "8de2e7f247e6931fdc9a8d41576fa221", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779199, "uuid": "2b144ee5-e43f-417c-9117-39eee7b6d1bc", "comment": "Malware payload (ArkeiStealer)", "value": "01c53fef4aaf190d3c7aa64467688a56cdb8dea688a1c93900ce9bd9341dbb66", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779199, "uuid": "e3591b01-ca91-4128-94a5-46f682fbee08", "comment": "Malware payload (ArkeiStealer)", "value": "414ff2259d06b9d7d8820910171e4e9d8271d336", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779199, "uuid": "040f3f99-2d12-4217-9532-e6592735375f", "comment": "Malware payload (ArkeiStealer)", "value": "29d298a9f9960b58a47e50723dd3a20fbf696a148c7092405f590bdde0ae068fae75ee1c86df969d1735df8b51e5a097", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779199, "uuid": "84b670fd-8204-4059-ba47-2726de079351", "value": "T1CF95C023B6A28837D13327789D2B97589C3AFE102E68584A6FF45E4C4F3D6817B142D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779199, "uuid": "d2cd07b9-7971-4037-84d2-c7638625cc70", "value": "6a515aaea12dc017aa18db3c955dd19c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779199, "uuid": "b25ead5f-6eff-495d-aa84-d78b0c2165c1", "value": "49152:S2BLdFlrI1kfDm5WfaZazZ3qp0AA1WXR:ThdFBI12xiaYCfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779199, "uuid": "ba30a0ba-6268-4e70-bc2f-498c33100914", "value": 1975296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779199, "uuid": "3f75e19d-04bb-4d17-85c8-33ae7bcef097", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779199, "uuid": "532d2af4-39c3-4a52-9a2a-79f5a137a82e", "value": "8de2e7f247e6931fdc9a8d41576fa221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4ba8d1-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764646, "uuid": "63aa2eb6-09fd-47d4-a796-2f270f2502b2", "comment": "Malware payload (Dridex)", "value": "f8eb06c52c5b2fa7fe7176fe785070f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764646, "uuid": "973c1684-daac-48bf-91d4-4f083185d993", "comment": "Malware payload (Dridex)", "value": "01d0e519c06add0d4b5d061b0c9783a0655b34138f0266540281e324230d1d34", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764646, "uuid": "5ddd9c1c-6703-4d6a-895b-465b1fa4072d", "comment": "Malware payload (Dridex)", "value": "d29f57eba4907067b05a10bd85dbba1b9baeb3ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764646, "uuid": "cc9a1a0b-5e2d-4cce-bd58-333aa08e14b4", "comment": "Malware payload (Dridex)", "value": "48abf4ed9e1bfae7c276b753e365174e07401cfb4ad0b076c023dce8ec0727481ab611817c344ffaac4df0cc22839066", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764646, "uuid": "9afee437-9afd-427d-8a3c-d1017ab9712f", "value": "T15C63F11D871874E6C3AAFC3E424D14BAA856E9124A84C7BF58A8B60C17F1B87B70D06D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764646, "uuid": "ffab9a5e-8269-4643-b9b7-59fb8ff22787", "value": "1536:UWmPZZKz/1eCzbqzLkh/OPvTFV94AnZvwO6traBFFUgds:VmEz/9qGWPvZVSqvv6laBfUgds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764646, "uuid": "4548a2f8-872f-49f5-80f9-1e6c389631f6", "value": 72978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764646, "uuid": "89e710f6-9493-4276-a052-6cf06ca6cf39", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764646, "uuid": "2e6c4367-8481-4026-914a-606a6bede3b0", "value": "8993268.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585011e2-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637778949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778949, "uuid": "6f516c83-86f9-4dfa-ad27-3d2be92441b8", "comment": "Malware payload (Formbook)", "value": "ff68bfd2c42065d9dd4efc7cbca5fa8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778949, "uuid": "d2e7b63f-9d0b-4363-a49e-4cb096c99223", "comment": "Malware payload (Formbook)", "value": "02770b935248ab8dc915413f9d9fc3090749bda9ed3185df7a8c253a76f8253f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778949, "uuid": "622473be-8347-4b22-b266-77eec7ba1875", "comment": "Malware payload (Formbook)", "value": "abfa6eb89412d327ab44f716c5161f3619ec0d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778949, "uuid": "2fe093cc-3628-4df3-a46c-0522bd78b615", "comment": "Malware payload (Formbook)", "value": "cd41a988ac8e63f93d93f8ad28f3b50ad08658822bb029fae6e5dbfbc8b672523a0419db9dea1a235ac1264ef08af707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778949, "uuid": "d5ca34fc-86aa-49cf-9f73-3d331f7b6309", "value": "T17494E08538DAD1E8FC3BEBB51CF5B9C50239F1E5E840A1DEE894295A88B37C44F50972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778949, "uuid": "4edca115-241b-480d-b47f-fce5e809b105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778949, "uuid": "0f041e63-3d6a-4bcc-8000-d05616f058fd", "value": "6144:JRanco3/esZvPLl6XSvoMdTtk+NyPZE1E4UdCEJttG+7Ghh13F2ze+n:aB3/e656qttk+G2E4+HJqh12Vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778949, "uuid": "6381a176-a2ff-44fa-95fe-6a781864ee42", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778949, "uuid": "c054aab1-2d5a-47ff-a7ef-0ca721471044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778949, "uuid": "b18b5a6d-36a6-490e-8cc1-d1f3a291bcca", "value": "FedEx Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fee5379-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637782317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782317, "uuid": "ea66295d-44ee-4857-b8ab-141192f63d64", "comment": "Malware payload (NanoCore)", "value": "6a4599e499c357e47ebdf9021cf4613b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782317, "uuid": "162a7de3-c4d6-41c9-b371-b121f95b5b5d", "comment": "Malware payload (NanoCore)", "value": "02d517033bd02f92877d038127bbda62dfa81cb34a6c0b98b3ab47c9ef614e8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782317, "uuid": "c7bd7c6f-af3a-44c9-a520-37412a049d2a", "comment": "Malware payload (NanoCore)", "value": "da9fab687ce9b7c1e06fd6a5af0ad85abe8d0e29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782317, "uuid": "afb80c87-3368-4a52-8900-06568a38f6b3", "comment": "Malware payload (NanoCore)", "value": "a9e63b6738a3abf23086edb6e8e3261e851e9111ee94a2b7e4e5dc91433aeb4ce7e49c35a035ec2eea6e97e2a9ccc913", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782317, "uuid": "332d9ad7-6dd2-46e4-88c9-e0a23ac7a5c0", "value": "T157F4F160F3D8CC97E5690AF19427994406B2EE6D2A1BD71EA8DE327A7D733830613347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782317, "uuid": "b269d332-1489-408d-a1b9-a7107c87509d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782317, "uuid": "fab09f6b-1724-408f-b6a4-c3e2baf43401", "value": "12288:EGvWeGt5S4UqJetrrgdYWZTAd+7eu9ECUgC6pC6B:bWR5DlJKPgYBOeCJCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782317, "uuid": "bf2505af-8ea5-468c-ba50-a6ec68ab7f48", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782317, "uuid": "49b26893-38ac-4d4d-8fde-17c9f4669bed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782317, "uuid": "f8be007c-6eb6-44f2-a952-6169dc6e9a8e", "value": "ERIG_0983763673-093876536783.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f435bc-4d27-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637759184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759184, "uuid": "870b7999-4890-448c-9305-2b393e4aefbc", "comment": "Malware payload (Mirai)", "value": "704570ba055b617cd977af1b74e5b154", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759184, "uuid": "16095194-2a50-4ede-b2ae-0a29fb3c1720", "comment": "Malware payload (Mirai)", "value": "0302421af8aa2a13416daf789d21c3e13c8b4fa335dee74aebb8252e28899f22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759184, "uuid": "ccca4ac1-bd46-41e7-a4f0-a789dc8bf67f", "comment": "Malware payload (Mirai)", "value": "0c7e15079e2577151b121ed2d71cf52755af711c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759184, "uuid": "07fe4bdf-1a9e-450b-8e1a-b77ae837c1e0", "comment": "Malware payload (Mirai)", "value": "2f4f1b4f0e48d0a7a4ae1005a5ba55280c4ff2d2c1c8401ba05e81553f3d4104312382908fa8c92782f32845212491dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759184, "uuid": "3a2e2204-8987-4260-af3c-706ad025a881", "value": "T13F931985BC919629C7D01377FE6F219E331193DCD2DA3206DC3417B87ACB94A4E2BA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759184, "uuid": "82087228-bd39-470f-90ae-a0941bbdcb83", "value": "1536:y4rnDaoZ5BEE/etWsbeeJo0Kqurj5S0k87RLsmms+3B4w7t6+2B1j5GQU4x/neZo:5nZnEE/etWjQCjrh+tPKjn5nwUSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637759184, "uuid": "73a3de6b-aba9-4617-ad41-6d9f6089902e", "value": 96552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637759184, "uuid": "10e51e14-e859-454d-86c3-a47794e560b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759184, "uuid": "c3d7079c-a24a-4ee0-8841-60138d705320", "value": "704570ba055b617cd977af1b74e5b154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb1eddb-4d3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637768331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768331, "uuid": "7523b0e6-8460-47d8-963d-e687560c6358", "comment": "Malware payload (Heodo)", "value": "8f6552b136a4dd8719c898f90df1ba44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768331, "uuid": "091fba28-2f82-4213-9ce0-f1832d578a16", "comment": "Malware payload (Heodo)", "value": "03995882170eb6ebacaa47f77fc0c2e8fd78e17ab5427fbe3c70b2f91f46e44d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768331, "uuid": "f32ff314-c055-47b5-802a-2c8aac8c3739", "comment": "Malware payload (Heodo)", "value": "fea5b1d5e44dc58be42e472254e9b62b5caec532", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768331, "uuid": "b4e0cba1-c4fb-443d-89ec-ba3f5f60288e", "comment": "Malware payload (Heodo)", "value": "5f129d7f0a0748f8a342edf70b754ae2e07b05d6b36a3477951455b34eb114c3c3ef8213c0300692878840330f4e55ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768331, "uuid": "bc0b1894-6d39-4643-86cb-12381dae3241", "value": "T163949D1325EDBDE2D5B9173037BBC7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768331, "uuid": "bbb4eefc-55f5-42d1-b3ee-99c5c5995cda", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768331, "uuid": "73c9a818-e202-4034-87f1-ff91fb1e412d", "value": "6144:1ACzUEcRRKxe0DUAldEzpLWE0sepO8+wM:1lxemHQtWE0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768331, "uuid": "f80f519c-d7d4-4c5d-999d-411b83b60ad8", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768331, "uuid": "e051dd03-dc20-43ef-bb22-49aba12048d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768331, "uuid": "75f34c7c-f8e1-4e65-bd2b-e264c219cb7c", "value": "8f6552b136a4dd8719c898f90df1ba44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe793e5a-4d04-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744438, "uuid": "0ca40d78-3dfb-466b-bd90-5e157793709b", "comment": "Malware payload", "value": "6ae9fef8108245902a05c36456c5d211", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744438, "uuid": "b20d4386-28b3-4bf9-8fd3-c99359f505f1", "comment": "Malware payload", "value": "040500d0bfcca08674d7c8ded89fbf5af5063c7c3ee4f85dffbba681337db315", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744438, "uuid": "edd5673e-3094-4662-807d-40601dc6820b", "comment": "Malware payload", "value": "cf4799281e086f66e6a220fb48f3f974f9d623be", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744438, "uuid": "684c7822-4b34-4c17-bae2-ae03f40bb927", "comment": "Malware payload", "value": "6ee59c909d45f0e7879a4a514b676ec83ded2210978e3cca140e21f2c0a1f15c2d72dc688005756644cbbebb34d903d8", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744438, "uuid": "e130fc5c-fcc2-455f-93bf-8e58ee565077", "value": "T1A9B5330C0379BCFDF95E42292B634EE1C1B9A1E1F5426192D2640CA89D3F5BD13EF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744438, "uuid": "0f450944-6f64-481d-b6ef-6d5f1e8656f1", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcME:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744438, "uuid": "70efc34c-f30c-443b-a917-c518d4bce511", "value": 2420736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744438, "uuid": "93dc17e3-5cfb-493d-ac9f-88f99b616a2e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744438, "uuid": "f91b9a7f-26fe-416c-b714-11825d0508e3", "value": "040500d0bfcca08674d7c8ded89fbf5af5063c7c3ee4f85dffbba681337db315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3625b266-4cfb-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637740237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740237, "uuid": "c3278dae-19c2-43e8-a50e-2ce4b5b08b25", "comment": "Malware payload (AveMariaRAT)", "value": "71d493e798c179f49c7e69e30afc0586", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740237, "uuid": "4596c478-a66b-455c-b9ed-3293bbf0738d", "comment": "Malware payload (AveMariaRAT)", "value": "04ab716eacfefbe5dc41cf04d169ea0e745c6baafd731d800f7c257ac01696fa", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740237, "uuid": "3a924632-a4ba-4f69-bff3-3bb00b789c7f", "comment": "Malware payload (AveMariaRAT)", "value": "b8d88628adefccf8438854d8f7a09535a4d34c99", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740237, "uuid": "effd68bf-8495-4bc6-8ad5-72c5cb6d258c", "comment": "Malware payload (AveMariaRAT)", "value": "787e14b6bcae68b79fc943e418ffbe9b18a4dc6b8edfa27dc227f808707bcc1f0331eb8d31384b486e2e9554eb336782", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740237, "uuid": "26213fbc-52f0-49df-9547-342c2f97a0ee", "value": "T13364F16072A5B3A7C9795FF80C2421C823B3B2453925C75D6DC9A2DF2E21F1ACB117A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740237, "uuid": "bce84af7-10d3-46e7-bac4-e2ee3f074c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740237, "uuid": "1a5714b6-1ed5-448d-8e59-676fcd6fcb33", "value": "6144:PiXKhKzGYYZbg30j9XzhzON/crUZCWJGYkDok/:PQsKzv+bg89O/coo+kDok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740237, "uuid": "aac5c949-b2cf-4d60-91c0-85fdcbf6acd7", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740237, "uuid": "d472b11a-6073-48c0-95ed-03d50d616bcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740237, "uuid": "fb322671-feca-4b69-b1a8-321e3cb4c5de", "value": "QPSHED-0421-0103r1 DOH XII_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea792dae-4d65-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637786066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786066, "uuid": "bf63c1fb-df0e-470d-95bb-ba85229bbf56", "comment": "Malware payload", "value": "9b041945d99e552cccff15f284b63d65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786066, "uuid": "b15af441-69cb-4e33-8379-d1449925eddf", "comment": "Malware payload", "value": "054c8720f04e72e4ff7fd6c39646829d02ecf9434cbc68e1a773a6f4deae0499", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786066, "uuid": "7e60b719-620b-4f6e-864a-4fa9d55720f1", "comment": "Malware payload", "value": "99d5c78096dee7d435b01bfac1775e4ba724263b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786066, "uuid": "fca27ade-da4d-4f7b-aff7-a99bffcc6e29", "comment": "Malware payload", "value": "2a040795babfd6dcbce66d3aa146a62e6ec0c52944985085a1d67f68abd72e6b8a5b491cbec89908648c555198a155f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786066, "uuid": "074e5184-80dc-4e92-9f1e-687352152db5", "value": "T10D056B88B54071DECC1BCB318935CC7496223DBA563A821E64CB3E6B7F7E5978A150B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786066, "uuid": "1200b65e-87f0-40d8-8292-3dcdcac39931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786066, "uuid": "821c9173-6c5d-46e5-80fe-77cd618a0347", "value": "12288:Xr7PsymtD00sdMCDnpPqIOQrhXYHT2ukXGj4WkeVWhus4OleIBGj/jQQK+7wP9G0:Xr4ymC0sdWQrODkk4MVWg1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637786066, "uuid": "ef509c32-1b78-4137-9ba9-55123b8ca7f7", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637786066, "uuid": "bf15ba5a-0ad5-48cf-8c23-221d65390d9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786066, "uuid": "12930a1b-9e58-4a71-9da1-b6a38b657594", "value": "Invoice&BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413a6918-4cd1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637722216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722216, "uuid": "66d120d2-66e6-4890-b223-5b43691233ca", "comment": "Malware payload (Mirai)", "value": "eb425840087543a00e375809a1e1a8d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722216, "uuid": "507edcac-69f7-4e74-9d81-1293cbaff5f4", "comment": "Malware payload (Mirai)", "value": "05f4b320a4a32e03c57588d509dddc32be9a9fcdf96a18a27c1ffe3232ae4ef7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722216, "uuid": "9d50637e-1757-4189-bfbd-a45478c536e4", "comment": "Malware payload (Mirai)", "value": "ef82361ccce401a77c3f5d27a490be93fb5b8669", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722216, "uuid": "c8bffbbe-6bbe-4d50-97bd-657a6b37eadf", "comment": "Malware payload (Mirai)", "value": "00e888d4e29353087422188dae5767e56c6afd3329f7c20484c500b01d8cd54f0de99c26f394c02e148eb437cf0635af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722216, "uuid": "002ffae7-d6e3-4460-8ab2-60dde50a5ddc", "value": "T11D538DA5C8A8ADACC6654978F6118839AB13F00C61A32DF6DA47C352945FDFCF0197F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722216, "uuid": "07f26ab2-dcf0-459b-bea1-2f83a6bd4a94", "value": "1536:v/pdlyGkBa9atiFxKyQ8MZso9tUsgfs3mO75IkDTnCxAi:vBdH4PtiFxKyu9tUHf+jqkXnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637722216, "uuid": "5d69dc5c-80fa-4ca1-b7d7-a53e7711f32c", "value": 66372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637722216, "uuid": "946b1705-6cab-496f-8855-41d6e78d46a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722216, "uuid": "3235f8a0-c697-4101-ac62-a966f6f7adc4", "value": "eb425840087543a00e375809a1e1a8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee921b4-4d62-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637784409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784409, "uuid": "84adc519-0711-4c7d-b775-dd74a5079b8f", "comment": "Malware payload", "value": "1d41e32ebf12225fb2895aced3d60e9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784409, "uuid": "76aa5d64-6e7a-48c1-90d9-7a1060d34e89", "comment": "Malware payload", "value": "0626da1000aa221c4f0c47872a0f33eabff9d952bdca540c6e35083e8a0ffabe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784409, "uuid": "5595e79f-9db3-44c8-ac23-d1201e4fd250", "comment": "Malware payload", "value": "63e74fa4f23e99abd88ffd250c850636a0138e8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784409, "uuid": "ceba23e8-16ec-43cb-b97f-f3fd3bf6ce29", "comment": "Malware payload", "value": "e6f9735e2ac11d99662b7978c270ec273133532adff12c2a472c6e54765c3ef371e782a48c653892a60488a67d82f8a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784409, "uuid": "22990e16-a6c5-48ec-a90c-3162445c67f7", "value": "T1C1C401943358ABA3CC394BF50D30D1C523B27556B544EA5EACCA21CE2E33B155B227BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784409, "uuid": "e3632649-82b2-4f41-9702-357bfa835e6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784409, "uuid": "19d7be61-d2ab-46a5-adad-47ea77430ab7", "value": "12288:Cv6tD00UizirSHrq1EDMTn3eu44JejuXtzlXrMfvWBPLm:Cv6C03irSHrcEwD3M4EuXdl7MfvMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784409, "uuid": "43d8955a-c026-472f-ab57-07636bf04cd4", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784409, "uuid": "070323c6-fac0-4534-952e-f71f24e37596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784409, "uuid": "5a1ff6b6-4fdf-49e0-866a-ff1eabcbcd9d", "value": "1d41e32ebf12225fb2895aced3d60e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab778f2a-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kutaki)", "timestamp": 1637762767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762767, "uuid": "cae3433d-74f1-4f9b-af00-23bf2b63d61a", "comment": "Malware payload (Kutaki)", "value": "032f4480781e0ed708241d92d8b6c718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762767, "uuid": "17bc6915-79d3-460e-80cd-03b052834900", "comment": "Malware payload (Kutaki)", "value": "064fe665dce5b2cf6d824290c2fdebea593f26b0c4b05efbdd3e300ab926900f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762767, "uuid": "b3303760-e4b9-4cc0-a7b0-17f8043915d1", "comment": "Malware payload (Kutaki)", "value": "1b1e6009b1d1f76ce17197bbda33fedd6e0e1175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762767, "uuid": "f004ca85-c162-4cc5-a5e4-1b180d01d435", "comment": "Malware payload (Kutaki)", "value": "0f54d3969158d3263b3af025513ac6ae860bfaf06852e5a7e5ff0b6a0df46d52a371f207d889e82e1da4e3a305dcd310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762767, "uuid": "3cd494b5-e610-4afa-8b7e-be33320a8786", "value": "T17065D636F8C1B85ED5E43AB11C753EF420A77D297A1B9D9639CCB12A16326C39824337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762767, "uuid": "8528f5ea-2099-4ac9-a4ec-dee1cdd98d73", "value": "484ffcacd4460549cb4c74890595505d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762767, "uuid": "2e296701-1080-4ebc-af42-958c026ab7d8", "value": "12288:Ps8a0Arz+46A9jmP/uhu/yMS08CkntxYRceAu5WS4dd:PmzJfmP/UDMS08Ckn3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762767, "uuid": "f735ff00-1d84-45d0-84fe-842c1ace8cf2", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762767, "uuid": "e4cda246-18af-491d-b44d-37dfe46b45c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762767, "uuid": "32b273fe-2873-4e6b-8e1c-c908760e7b8e", "value": "GST-48B3.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ee69eb-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637736585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736585, "uuid": "f0ef9ed1-fa68-49d6-a944-fdaefe6340b6", "comment": "Malware payload (Mirai)", "value": "b2a3d3e5636ae4e3747be1f84823cffc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736585, "uuid": "60cd4266-ae69-4a12-bfee-444cc89e0750", "comment": "Malware payload (Mirai)", "value": "066a566ba655eda617fbe43bf7278ffbf5af7136e41da8d73ef79737da95120c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736585, "uuid": "63175bfe-73b0-4113-81cb-d336947900c7", "comment": "Malware payload (Mirai)", "value": "6559035ca3b4ea1626d73096e3e74e5d2ea40b0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736585, "uuid": "ec2d0d6a-f6c4-4285-afed-f571d7b125ec", "comment": "Malware payload (Mirai)", "value": "53edca31857678090a3b48094a72bb581dd69fa0a0cd828517c7cfd54d6087cfe186b38395c8f0f557d9133e0f8e2b0a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736585, "uuid": "0d06ba45-a668-42e9-9d7b-f7b01c94fd64", "value": "T14A832885BE82AA16C6C543BBFB4E43CD33226398D3ED7213DD156F11778B92B096B051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736585, "uuid": "417782d5-510b-4d70-bd2b-77a40885af3f", "value": "1536:Nj9qAAKx7QvtGsU9lnEDSy8ZPzQ+PZB0Fz6exycGTzGnv8CaxvR4TwbZnx:NYAjXsslWSnzQ+PUeeycGevfUywbZnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736585, "uuid": "8807e435-aebe-45e5-ad19-5bdbfe025701", "value": 84580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736585, "uuid": "d504333f-19d0-43a1-8bbd-506213aba3ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736585, "uuid": "df3bac41-40b1-41c0-a1b4-13cef19c5347", "value": "arm-20211124-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf05ffc-4d28-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637759872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759872, "uuid": "05ed0f70-bb40-4d3b-9363-83bda24ca2ff", "comment": "Malware payload (AgentTesla)", "value": "3c6afa1aa3540fbbc2742556ed6db500", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759872, "uuid": "77a45b08-b8a8-488b-89d1-ee3a9fee7def", "comment": "Malware payload (AgentTesla)", "value": "076615a8d4411ddd174a22fa11ba44abdeb282cbf6df003b2c94e77172f7eb2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759872, "uuid": "5504f143-a295-4f3d-8529-54101eaeb568", "comment": "Malware payload (AgentTesla)", "value": "ed824f28927432d9a4e86ff89bdfa287eeb5bf93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759872, "uuid": "0ae4546f-4347-47bb-8026-3f7072cda0b0", "comment": "Malware payload (AgentTesla)", "value": "409ef0a75c6efb9cbb9522bdbcd21939799ded63a9c5aaf4c8d5095f6a3c94e51c011b1ade445ef01d8aa85291d17615", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759872, "uuid": "6c257e4d-9447-4ee5-9c09-bc3efa461649", "value": "T1A5C401353A93DA62F5695777C58A10441330AA007AA3E32F79EC331E1852BE73B55ECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759872, "uuid": "45379732-d06a-4484-9dbe-d5afbf0168f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759872, "uuid": "4adea897-cf84-4af7-9a8d-c5c9b3e2ccba", "value": "12288:Yk8rBz1IL9o28AsvFp+pEtmGfdK4Q6f8ty7hDkS0UUm4:39d7sdQIfc4Qq+8hDzUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637759872, "uuid": "d98dc3d0-c839-49ba-a390-be03527f0c37", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637759872, "uuid": "be4d6b14-11e6-425f-9459-aa9e88a9b6f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759872, "uuid": "b7eaceec-7d5e-445e-9bf2-a7c9b15317be", "value": "Euro invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615ee93b-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637772521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772521, "uuid": "ec7eab20-f2b4-4d44-8162-dd7ede530e5b", "comment": "Malware payload (Dridex)", "value": "2b8681f61b27637fad4a869f6919ae8c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772521, "uuid": "7e77d86c-0130-493f-9284-7dcd476f00e8", "comment": "Malware payload (Dridex)", "value": "07bf10a4d9562de9b3e5e2f93b7a6c323c1695a0d37456d22b4fd8d0e4dfbbe2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772521, "uuid": "99cd3835-95f0-4ba7-bfb3-564028a8e88b", "comment": "Malware payload (Dridex)", "value": "640161f8f6e6343cae2793590a5d27e5b0978ca2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772521, "uuid": "b8b0e8be-010b-49fb-bebb-e79b57e45065", "comment": "Malware payload (Dridex)", "value": "13f6069c4e91aa63f91fddf6420de0238503b0fb955a2f32c645c4e8b669c22cdab623a74393dd75d77631a15e60d539", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772521, "uuid": "41a25d55-7ed5-4264-80bc-9a93f9ad5e50", "value": "T150F47C67440FD860F6C58A3977BC6885ED85E2628F123FBAB9422C2563352BCD5B3317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772521, "uuid": "daeba1f7-8024-47c5-b3cf-aba8658d57ee", "value": "3408863a87d01409eccbe58d6d3e764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772521, "uuid": "ca544811-c4d1-4144-953e-36860e80dc1a", "value": "6144:QmH70ZwiaiIiu4KiU0OiaiOw8i4isCAiKeoiyj3o10Yxc7Ijse4WjPPMOnnnzi1m:JQRDlh/tRVPT1rTjybATge4W70OnG1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772521, "uuid": "1591f5e5-1083-470f-9d58-72b7d5c6a86b", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772521, "uuid": "4df6fb2f-0cd0-4aed-9eb8-4e631885bc51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772521, "uuid": "7cc251e8-bce1-471f-ab48-eb35471a6115", "value": "SecuriteInfo.com.Variant.Fragtor.44159.9257.13268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f6e9f8-4d19-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637753442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637753442, "uuid": "1e787b05-1f17-4536-a5e9-8697a28f74ec", "comment": "Malware payload (Loki)", "value": "5b1895b41820cd2eeacb9ffcab5cd980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637753442, "uuid": "f18c34d9-dddb-43e6-9885-56d333e7aa80", "comment": "Malware payload (Loki)", "value": "0820fba4cf1e636a0d564f6938a7d1ed76bf1319e6926714f9322a910e4c0008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637753442, "uuid": "34f5beb4-b041-4567-a80e-34cd8e8c8d6c", "comment": "Malware payload (Loki)", "value": "5210da153e70a1cee09715d9499ad5e99d4395c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637753442, "uuid": "2e231df4-8a5c-4fd0-9657-b0818e9c96c5", "comment": "Malware payload (Loki)", "value": "8f8b13a34f89d77530d6ddf134f6585164010b27b8bb159336b16bb4c2e8e85e95ea363eb3bff22cfa2ef5cc84c677ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637753442, "uuid": "cabf93aa-f8ce-4340-bd76-f8b4853ef594", "value": "T112541243A6E2687BDF851A3085BBB36BF97EE15855674B1707382E730F52CC29E05482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637753442, "uuid": "6c8153ca-281f-4166-bf53-04bf4470fc38", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637753442, "uuid": "4aaa3954-a22e-475d-8043-2d090aed9285", "value": "6144:rGi/I8cBl066MioJ0DzzCYX+f1kN3ARaVvL8jx+KYM06n3qe+r64q9drx:7IpBG6fiKYjPARaVvsgKYM06nae+redd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637753442, "uuid": "fb144b9b-d1c6-456e-9dde-1effde27bd4b", "value": 300840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637753442, "uuid": "53592e7a-dfd1-4e55-b8b9-95066ea9a36a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637753442, "uuid": "1f57f280-691f-4b9f-87d9-a0861ae6255b", "value": "Nota de aviso de pago del 24.11.2021.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409247c6-4d42-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637770748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637770748, "uuid": "ccd6d093-df1c-4aab-adec-156eaf8f7a2a", "comment": "Malware payload (Dridex)", "value": "5c3d6e0b50e770f9179c9e42f8425147", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637770748, "uuid": "6b47f4ea-0dc7-4c25-8315-403f5dce4f29", "comment": "Malware payload (Dridex)", "value": "0852bdc3a7c96b432e62fda0a7d2390d04eaf5f7478b45e8a85fd3549db60b9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637770748, "uuid": "e96be588-c6ae-4ede-8492-36e6a919050b", "comment": "Malware payload (Dridex)", "value": "fcb24500e65d0b40ce3a031fad41e9a3b6a530b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637770748, "uuid": "1fdf221c-1807-454a-a172-02595842be7b", "comment": "Malware payload (Dridex)", "value": "4437a4c0edaadd3be878e28fdec29548af854c83819106f663d445ee34f340f90e043aff6eeee529134359eca69d5f64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637770748, "uuid": "7b9420e4-b7f1-4561-9be6-c42082d321b6", "value": "T14FF49E3375711882E55113FAC8E53372DF17EB8588D01CD90F98BA9608BADF9A8C9DE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637770748, "uuid": "19ecec1d-d03d-4572-a48a-c329ac58e592", "value": "aad41bc76bfe216cfc48b81f52e4aae9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637770748, "uuid": "bb86d881-8da2-44cd-a0e7-fb0adafa8e4a", "value": "6144:zIiOww28O6OKaSYqiI4wgYMsXvKVE4C8WDOrIyiafz0AyeCEkTjFtRg2rQlftW9O:oXyVrpWOrIRvBFw28RtGkl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637770748, "uuid": "ec24c1f3-fbdb-4f26-b8e9-07b74b369cf0", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637770748, "uuid": "1fa5383b-4ce5-4c20-b183-dac23d0ca602", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637770748, "uuid": "453d0ce9-4a33-4d25-9f34-464f589833e2", "value": "jPzSCuyellowfacebrownietacohead.ogg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff67db84-4d04-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744440, "uuid": "1798be46-4134-44f2-aa94-1fe2882930ea", "comment": "Malware payload", "value": "2769d4e6a768d797430f15f0b4016b6b", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744440, "uuid": "3ef4464c-95d5-45cb-9638-d54633bd54ec", "comment": "Malware payload", "value": "08e8621920731406fe5a1fafe715646ce8bb6b91b986e117cabba357eec80737", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744440, "uuid": "80bbc330-f4ef-4c9b-b523-56bd7892cce4", "comment": "Malware payload", "value": "ad4f835a59bf6258450c62ecaa5ccc6501b8b159", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744440, "uuid": "ff42560e-698b-4c61-ba14-11ec35e3c964", "comment": "Malware payload", "value": "f69c28acc4bfc32db5dd940492d14e1127107f68f855ab0603a66d144a416c68de7f8be5dda5b76cb825c4e7091d8fe4", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744440, "uuid": "aa47ba0f-6b9a-4707-b25b-019a8e48713b", "value": "T13AE533794E3B69C7503D2616985643F39621BCEE1C28F016E3FE96DD348E4F498C2BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744440, "uuid": "d6ee68fa-cd92-411b-ad13-259feeccd790", "value": "98304:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKR7O4gLtubex6E6H7Ycp8:R4FEQETHt3/b2TdR7Xgqo6F3p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744440, "uuid": "0629560c-c37e-47bd-b4a4-d9c7afb0c9f2", "value": 3313664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744440, "uuid": "bcc40c3f-e70d-4e26-af5d-421f1a2bb5ff", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744440, "uuid": "734764b1-7432-4246-8ce9-27b2d301a355", "value": "08e8621920731406fe5a1fafe715646ce8bb6b91b986e117cabba357eec80737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d776f609-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637774437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774437, "uuid": "3bc1c518-6eb0-44ad-8df7-43f631c20772", "comment": "Malware payload (AgentTesla)", "value": "500e428fa0bf99abd03f9bff8f67cf8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774437, "uuid": "20372785-0e0b-4194-852a-a48c47822fc2", "comment": "Malware payload (AgentTesla)", "value": "09229f9f4698edc003571daae852c56be528fbdc2d8bbff93dd684486560bf10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774437, "uuid": "779f7b2b-5edf-4693-8630-12ccfe00819a", "comment": "Malware payload (AgentTesla)", "value": "6f403cec0fd7ca05252452da96c642557dc818f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774437, "uuid": "67632790-ee57-46e3-9c27-23e4fc450b14", "comment": "Malware payload (AgentTesla)", "value": "fcdb7241e664196b725ac20f64a2b8a4e23dc1a974cb3c09c152afedc653787f64895e7ff3180ce998a9b9900f039d9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774437, "uuid": "01d6d322-37ca-4b71-b792-e573e01b5c39", "value": "T101A4022032D5B253CCB68FB7295521C057B1E2563E11D7AF3CC8238E6D6AB5E4B22763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774437, "uuid": "9cd92118-8242-4f36-8c39-2cd42c7e7bda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774437, "uuid": "79dbf5c1-fcb8-423d-b828-0a861d2ccda3", "value": "12288:eiiEGwB894MsMaJgqCpDAtpC0+oPUhsUCDruTcse:et889kMaJg3DAksUhs7Dac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774437, "uuid": "6d53e56f-10f9-43f3-a408-24f0761421b4", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774437, "uuid": "ac568567-472a-4f36-bd3b-25f2bf55114c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774437, "uuid": "c0b955cf-1cad-43fe-ad1c-62e609ce3d03", "value": "Payment Invoice#0043t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49c27ca-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637736583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736583, "uuid": "843baf9d-da48-459a-a6c2-d06a39b2b8a0", "comment": "Malware payload (Mirai)", "value": "5b4184ee046fb0d58bdfb6fd6ce76855", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736583, "uuid": "694fb8e1-2163-4935-813a-4807f3a14796", "comment": "Malware payload (Mirai)", "value": "09f6d3576b29db12189509d5e9dc54fdc5ff0bbddb0bda98fd19baf02fda50dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736583, "uuid": "3a6aba70-43a4-462e-aa86-833356141332", "comment": "Malware payload (Mirai)", "value": "08cf95159911e41133e4a41fa8d4b584c6079193", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736583, "uuid": "7405de7c-d709-4483-babc-1209f443ea57", "comment": "Malware payload (Mirai)", "value": "7a9f6ccbf9486b89e9049c3776fb32a602655835fd451cb04016532215670733dab342ba76e84957bb7cdcc3eb177231", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736583, "uuid": "9e3d6c3e-fcb3-4d29-a428-c1f2bc14846a", "value": "T179734B1361D084FCC49AE2715FBF522AF523F07D0235F59D2398BE22BD0AE221B5E599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736583, "uuid": "93a26d7b-cb52-4339-a4fe-195768057399", "value": "1536:LgwYodgrt87G5rDrdhQSTYeyjnWhT7DAJBKXBYteTBnk2:LgwfwtS0PrdXk5jns7D2KXBYteTBnk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736583, "uuid": "d44f3670-8ba6-4af4-8ec1-6af9d26bc72f", "value": 75904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736583, "uuid": "b1dea053-e861-4f67-aa48-81c378bccb75", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736583, "uuid": "42c741e9-309c-4c4d-80a0-b8ff303cbc49", "value": "x86_64-20211124-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84415479-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637774727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774727, "uuid": "e704e301-d521-4656-b1ec-76357798881f", "comment": "Malware payload", "value": "0ff60c4ab4fda1996dea72e85fa50c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774727, "uuid": "c4af7287-6788-406d-9c44-ba20de9a322e", "comment": "Malware payload", "value": "0a10118e019b65d33d000f0d982f0d39be3a9164d4f51513f6f4f2157cd67205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774727, "uuid": "c73db103-f9c6-4153-9c5d-d34517e93ef6", "comment": "Malware payload", "value": "1e03b5eb2e7b9c386923e547faa728dc6ee4ddb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774727, "uuid": "4bb7d03c-6401-41b3-bb17-456f75b6414b", "comment": "Malware payload", "value": "d9fa60f9527cd87a54ff7755a1d6a9dee50a6270b60addb078f108abbc86a10a1a75694ac5642e90640e9fd5d76e6a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774727, "uuid": "2e7ba5cf-f204-48e9-b55f-c05e7196d8bb", "value": "T146038E42F539C663C2D9CFF3D6A7D28403F1F6439313C54EA49A730A289336ED952656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774727, "uuid": "c203f9c4-ed1f-4667-9650-461c3abb079b", "value": "768:EB47ZtkInV35cQvIIiyk+bVEuVXnRnqQNLxwwS:l7ZtkCRQ+95Ftqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774727, "uuid": "ff20edc2-0307-4fc5-a634-b41d3a22fe0b", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774727, "uuid": "3ef9e322-931c-4eba-a0d3-9aeeb80a240f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774727, "uuid": "10f5971f-f3a7-4b04-8f26-ce820f394a77", "value": "0a10118e019b65d33d000f0d982f0d39be3a9164d4f51513f6f4f2157cd67205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc229d9-4d33-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764513, "uuid": "18dd534d-3a6e-4edd-b9e7-9fa27eb5312b", "comment": "Malware payload (Dridex)", "value": "fea372fbc18e561b0ad7fc8fd4fa78e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764513, "uuid": "237da002-98e9-4cd9-86da-7a7ffc92830f", "comment": "Malware payload (Dridex)", "value": "0a1efee00f003b2d9ddc4c892ea86de95c34f0a5e8f1546c7957fbc7955a029b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764513, "uuid": "98a7b8f0-0f41-4665-8737-1a062db16cd2", "comment": "Malware payload (Dridex)", "value": "4ce41f66965cae78d988df7aaa650f8988d7dd1d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764513, "uuid": "e92297d6-0cfc-4105-8202-d1195d87f1bd", "comment": "Malware payload (Dridex)", "value": "991a30c19ba2e51fabc126f63d19d6f832482b655ff7d4aa4ad2714dde9a33a4eddd0bfc291fb15b51db3fc1b148a9cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764513, "uuid": "3d2519fc-3b31-4796-b6e4-1398a64e1584", "value": "T1866302B9C0E67408CE7CA57CA04E5EB4580BA84697A5C15F3DBCBE581E2290F9F5F138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764513, "uuid": "70dd15dd-0ff7-4b57-9da6-1600be5271e8", "value": "1536:UWHPFwJpvc1e+BwT8YIbDMz+1d6xjYpmG7iOnh+MaEQ9tgdDc:VgMrbDu+1d6xjzG7hraXtgdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764513, "uuid": "b1cfb787-ad60-4270-985e-a07ff29c2f4c", "value": 70700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764513, "uuid": "a1b3212a-1374-4bff-9ab7-f6e6db5aad98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764513, "uuid": "210d8bcc-9a96-43b7-9c08-1244f6209c7a", "value": "tax payment12248998.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d85fa6-4d26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637758865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758865, "uuid": "93edb73b-1d23-4993-9761-3160bc9278bf", "comment": "Malware payload (Mirai)", "value": "939cdd7834da2a6cf392bb547e722c2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758865, "uuid": "5925fca2-2ed5-43e1-8a9b-c40c1a9576ce", "comment": "Malware payload (Mirai)", "value": "0b01e649a6fbe5002a6dc33ee31ad04e0d1f3d4e9553dc451fa4b7893a761ce7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758865, "uuid": "da867c2d-73a6-4480-b241-5168fcc4958a", "comment": "Malware payload (Mirai)", "value": "ed972fda16418be9e7ebe6204d9e702f49b8a88e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758865, "uuid": "f2ac79f8-51a7-41aa-8f34-8ab41aafc159", "comment": "Malware payload (Mirai)", "value": "0e9da374e9e2d4903160caf6b6abdce0c61e23c49724793f5fc84800d3541b190fd0a74632ddff231f0d7b959926e4f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758865, "uuid": "86d86267-34e1-48f9-8db9-938f68878464", "value": "T185D31986B8819B10C6C226B7FE2F018E3312579CE3DA72529D245F7477CB91B0E3B959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758865, "uuid": "a2c87d9a-abc4-4f34-a02e-8a26d418364f", "value": "3072:xI4CB4ZNe837xlws+Zr5hMo0om/jxap1S9xCrLhV2:x1Cme83D+Zrsz9tajS9G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758865, "uuid": "bc00a438-cf98-4380-843b-bde493d76856", "value": 132504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758865, "uuid": "f43b55c4-d011-4ab4-834d-d4c7dc12eac3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758865, "uuid": "76df9b9a-e111-4bcb-87a3-14ccc3ece2eb", "value": "939cdd7834da2a6cf392bb547e722c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d73e38-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1637779204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779204, "uuid": "c4bdadd7-bf49-429c-91f7-bd881c66d84f", "comment": "Malware payload (CoinMiner)", "value": "1d4f3985b2b3268dd16bf33300227551", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779204, "uuid": "c66de732-e6e4-4e3c-95fe-6ffd1af69fe7", "comment": "Malware payload (CoinMiner)", "value": "0b146e27011b69ff39ebf85dcd1459aaf66584ef728aab4786970d6f9c2072ad", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779204, "uuid": "e7adc2ec-98e7-47ee-9e58-6d8944fc1ee7", "comment": "Malware payload (CoinMiner)", "value": "1f243006ad330d7f63bbb8c142cbc83574ecd2b2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779204, "uuid": "3745ed20-e9a8-47cc-9136-4b815dcbc132", "comment": "Malware payload (CoinMiner)", "value": "20385bae947c793fd33306b5b2372a811b1fdd87dd868db37293464d4a082ac6934c487dcb46bdcaac3a1fae9f1cf7bf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779204, "uuid": "95f38eb0-2d99-49f1-adc3-49d1e12d4d27", "value": "T12E6623BF11A8736CC01E88385433ED44B1F6251F47E9D6AEB1EFB5C037AA8158A46F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779204, "uuid": "9f6d612b-9153-47d5-8185-507b116f6731", "value": "889336afd01a952ba79d1e90fb751739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779204, "uuid": "45c8cf47-adcb-4530-828e-a8d085af9726", "value": "98304:M5zUVhIjQ9dPlDGCtDyuWAohKrJKUjTJGziqT9hIQywOxl4usMTEb88uRLbh:tIjQ9RpDyu+KzGeqPIvwOz26n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779204, "uuid": "e5ca6eaa-d073-475a-b80e-6e8a5fc8dfd2", "value": 7048704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779204, "uuid": "77a6e178-1277-44f5-b98e-97cee925a268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779204, "uuid": "95a9f4c4-2f52-4d38-9744-19c95fa044fd", "value": "1d4f3985b2b3268dd16bf33300227551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16720595-4d61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637783992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783992, "uuid": "52db6384-9e64-4d3a-998b-a58b11dc1bd4", "comment": "Malware payload", "value": "d54c655c7cb11b1416acdf05ccce72db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783992, "uuid": "d65fd46b-1f79-404e-9860-f5d536bd69ba", "comment": "Malware payload", "value": "0b3cbee1c71bcbeb15d46c14d63e8394331896b919b591fe69fa750a2d18684e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783992, "uuid": "3cb3e604-88c9-4709-b1cd-5ce3bcb79e8f", "comment": "Malware payload", "value": "9fc1af099504d8c427e703747941a0e68cc4a4f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783992, "uuid": "96e01101-72e5-4a55-a6eb-b0e987c3abbe", "comment": "Malware payload", "value": "b8ff0835e0d0b2fc89795b61879fed4dba0ac1de24cf98daa7d7b3e06ca1cccf23559132055db5f3013ba3ed8235bc8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783992, "uuid": "13d2f929-177d-460a-bd11-5ff33d60e162", "value": "T1546522A56D85EAABDD6402314624CA74D366FE63B6109CDAF01F3A5FDEFE4E14C30902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783992, "uuid": "eb46d168-d249-4355-abbf-6633b810c754", "value": "c4b23eb508614b8e11c1fec0e7f1b2bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783992, "uuid": "6c08889e-0b23-4403-9d15-c7c792f29606", "value": "24576:tw2NsmTVudEiBJlysqAO8ljmFEN47b+GVXAGf983VlCMpJM48vZmks7namWq7IqM:tw2NsmTYdEiBJlysLdq2O1AGfyFlCGmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637783992, "uuid": "b9ff0d17-3ab7-4061-8a46-833705625d60", "value": 1533024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637783992, "uuid": "c69609ab-63b6-4ec7-b57d-39337b26019c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783992, "uuid": "66c367de-db06-466c-b933-18a28f00e504", "value": "d54c655c7cb11b1416acdf05ccce72db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8adb46b-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774413, "uuid": "81fcc7e0-ad95-43cd-abae-bf85148103fb", "comment": "Malware payload (SnakeKeylogger)", "value": "604682057909b8ae6b41b58dbc35c91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774413, "uuid": "a6b047be-1265-4c02-9895-871cec4dae97", "comment": "Malware payload (SnakeKeylogger)", "value": "0ca5da355345539f5d081daff3f8056bec8ba2670433c36a9359f30f94426f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774413, "uuid": "fda9836f-9717-41e1-b8c1-c89c9f37e0f4", "comment": "Malware payload (SnakeKeylogger)", "value": "66fa25b16b682781ed571e8548c99cb65088b82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774413, "uuid": "b0c0779c-a2b6-4c0d-b999-848cee809b96", "comment": "Malware payload (SnakeKeylogger)", "value": "461657ddd3c8013365a35952abe1677526549f9aea05ff58db5ad34ca9d0a60aa5efdcbc362090e60c90e7e8b3ce5204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774413, "uuid": "3123b6a8-3d97-412f-b6c1-bac21dbaa8a0", "value": "T1C505BE1AE322FC10F6AC6BF9DB735B700761EDB6AD51C203A378356594372B92988743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774413, "uuid": "2565e3e0-0f4c-4cdb-a45a-2f8b8f86e148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774413, "uuid": "d27a666c-8166-4c3c-abba-5504d10e4d12", "value": "12288:V1ehB87MY+Icfet427is3227RsZz6ZNO7zYAbT0+Ni/K2eKoImBYU5z+6OsjvJp2:yhJfet40is3227RsN6v3On7z+6Os1p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774413, "uuid": "51008911-f86b-47d7-8e7b-81434db18d20", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774413, "uuid": "647a9b88-21a9-4162-855e-0084ad030fcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774413, "uuid": "69a6f422-6704-4d20-bdb8-60e361e1e5e0", "value": "BGZLPVEZCGVQCMKI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71ec951-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637776074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776074, "uuid": "ad785235-6dec-4997-be23-7b991ab7daaa", "comment": "Malware payload (AgentTesla)", "value": "17ddfdbca81f6c8214406720867549f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776074, "uuid": "d250042b-7214-45c4-95e0-9f6533cc7419", "comment": "Malware payload (AgentTesla)", "value": "0d407a8cd27641e63ee9b446bc3128a91433a6bebc4f37ee11779a9faf94a655", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776074, "uuid": "d9e16507-ac0a-406b-8fbe-1e2017facbc2", "comment": "Malware payload (AgentTesla)", "value": "1bf9c02f6aaeb9603b030717517b1f64cec5099b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776074, "uuid": "b5f6cac1-9f00-4869-8003-c3c3b12e79e9", "comment": "Malware payload (AgentTesla)", "value": "91b34537be248393a75deed665f51951fd99ee174f0c18f48fa4006eaf4e3988b7c7a526180e4f4b688a27f8fdbac4ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776074, "uuid": "e27e6b15-fd34-4fce-8188-9e7b1c8e580d", "value": "T1493402683AD54D46CFF2CB70481AEF92C13ACDB772127766357AB85E71B4A030605BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776074, "uuid": "1747fe5c-63e9-4f9b-be55-6bcecf7ac27a", "value": "6144:puQGcE6KWFjefZE1du+xehPB1lE/VCOk+HRy7ME8fbMxIGnP:9elWRefa1XDYOk+HRyJ8fbMxIGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776074, "uuid": "4fb6399e-2718-4384-a203-527a199479e5", "value": 234536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776074, "uuid": "f02a546b-57cf-41af-9c74-33ac4fc447d3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776074, "uuid": "5821e855-7247-42dc-a15c-d8a4008cd047", "value": "PO PENANG ORDER C0023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ad1484-4cf1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637736020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736020, "uuid": "3fcb1b1b-d29c-49c1-be7e-b38ba5853e1f", "comment": "Malware payload", "value": "532d38e9dca85aa9d58a9fe91cf42a2e", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736020, "uuid": "18a69a92-8a32-48fe-805e-1ec91779f971", "comment": "Malware payload", "value": "0dfbe88577b3b70eaa37d5ea2674de07375d452dbe892358c68fad4288f355cd", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736020, "uuid": "49f2ac23-3afe-4ccd-bc07-e3556d4e9433", "comment": "Malware payload", "value": "24cfc3c94b8012dfe16e882411d7580c9256ce50", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736020, "uuid": "1db96642-a4b5-4ff3-a5a6-afd87674c6e7", "comment": "Malware payload", "value": "eb78f785d5393c32c079a9e82eed66519e7445bc6761b54fcdb87b53cde88d69cab786f56f0a12decfcc30bbff82a5d8", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736020, "uuid": "deb3923c-107a-47b2-b712-8d45c37e1eb0", "value": "T1E1F276A80146535AC3A322E5FB2AF048772BF51958E4C4E871EFC3BD617B9ECE112572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736020, "uuid": "b6eee97e-dd39-4873-8fb3-899ab0f13dac", "value": "384:lNg3oyVFKw0zybdKkIw1vgMix9Nri6rGsNAYAXJqskGD:lNg3gwPq9fhAZqCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736020, "uuid": "44f3c847-0c22-46db-8011-bdfe056aa5e9", "value": 35075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736020, "uuid": "2ef3b06a-57a4-499a-b7cd-84ec7f8bb456", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736020, "uuid": "6e01b849-09fd-4d52-b85d-ead337ee92f7", "value": "Mrs Rosetta Yusuf.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ced7a7-4d20-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637756179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756179, "uuid": "4dc919c4-fd0a-47fb-ab45-3105f02f0cc0", "comment": "Malware payload (Loki)", "value": "6a50fbdc73b780deb3112514ca444a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756179, "uuid": "8459620f-4632-4c63-b5d4-9b06a0a21688", "comment": "Malware payload (Loki)", "value": "0eecd143d84fde7775035d32a7b7cfdce6a909f5aee9908b93d8d4a942da44a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756179, "uuid": "aacc002b-b717-43ed-9078-8ca870b7b80f", "comment": "Malware payload (Loki)", "value": "ae8f9fd93872553e89d52b0c9d0289d4e0a0fcb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756179, "uuid": "90470aea-4a43-4f99-8ca1-68101bebe513", "comment": "Malware payload (Loki)", "value": "fa225acace3c8ee048a2ce45b5731c06af04d24327a11ffc19d02a69d5dbbca8d9b7072bd612395f5e3450a444b24e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756179, "uuid": "cf80fe4f-4c57-4e53-afb3-9f2171732b57", "value": "T149E41A15E3D384C8E93C97F48D737F580A5CA9BA8C504F87BFA83659A03E27515B920E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756179, "uuid": "a60a6d14-afab-443a-8f0b-f0ac8267b42e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756179, "uuid": "88be2692-4bb7-44ba-ac41-1f54b1465f98", "value": "12288:t/iSlOfjRXEXq26DItvz5wRrdR4yoD2picrhe9F:t/iSERD/kD0roXDQico", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756179, "uuid": "2959eeff-2d57-4882-abc0-432abd5e0bc8", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756179, "uuid": "1d875aeb-fc8f-430c-bf0a-6b4808a01824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756179, "uuid": "fde33d64-0f55-49a5-a059-4c675324e551", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fbfb71-4cfc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637740872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740872, "uuid": "7b2ea819-8093-40c7-b63b-cc83bbf7a96f", "comment": "Malware payload", "value": "8d7511e577f6fae20677b424087a4503", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740872, "uuid": "f179b8e9-7ea8-4459-8798-1beff7b241f6", "comment": "Malware payload", "value": "0f3fc83f646f1a40b4c5083a23f2407e5c83e79d9096c9a42a25c5e59ba2e44e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740872, "uuid": "f5389499-26d3-4289-909a-8ac345a85f01", "comment": "Malware payload", "value": "e5e0d8b5483aa9d1e4253a2d5a1a1e488c0fb958", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740872, "uuid": "9f4568c2-ee7a-478e-bdf7-b0694491dd26", "comment": "Malware payload", "value": "449426edf77bc8156e2361c6f95c74628fd59df2480d341ae022ad35a72f6c68b9f2ecdcbe727190ff5baeb4fb9e9be8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740872, "uuid": "655277a7-5860-4332-9f44-ab45948b1159", "value": "T1302501990BE74A8CE05329BC0A14D538F264DD52252BD7528BF38C6BFF787C1ADC1986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740872, "uuid": "585397fa-b417-4df1-b2d6-4e265e0b0ae7", "value": "224ba7bfb61e7e5b30045124437cde83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740872, "uuid": "537e3f98-b936-48a5-ba7a-914276f31c7e", "value": "12288:hQi/vB03+w52k+evcTtnU7qBB7GBKaOcPOj2BI2xZFTJWOa9vxIQ2+D5OXcv:xHB0+wX+XqmB79vcPOiBVxZs9JIZosX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740872, "uuid": "f231e5b3-4140-4aa5-a665-1a071b09a6a2", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740872, "uuid": "0b2481c8-7b1a-4625-827a-c1cad51e92ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740872, "uuid": "7a448ef7-ef04-4448-81f7-1dc5a3dc082a", "value": "0f3fc83f646f1a40b4c5083a23f2407e5c83e79d9096c9a42a25c5e59ba2e44e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8b4891-4d41-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637770398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637770398, "uuid": "e2b24228-1902-492f-885a-d5b1eee214ae", "comment": "Malware payload (Dridex)", "value": "fcef4a50b44e5221394f6b3d6a6cd5c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637770398, "uuid": "b14ceb49-fe79-4387-bf58-953b4e251c61", "comment": "Malware payload (Dridex)", "value": "0fd6a498cce81db56bd7025605feef81e651e1b95b63faa39884e2ce0247f6d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637770398, "uuid": "aa02c0f6-6df4-454b-b34e-115f86f17fe4", "comment": "Malware payload (Dridex)", "value": "241810511e16e8e12a930cce9c110f8be1e14a0a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637770398, "uuid": "998fd581-c90f-4474-8d23-db0ce20a01e1", "comment": "Malware payload (Dridex)", "value": "ae6f5878ef49425b7ab258caf50bfbc95c0892bcc3aad3c4cfd7bb07e94a674110860d21e2066c2df57b91e551ad8236", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637770398, "uuid": "bc7927e9-557a-4e52-80f6-4beaae116906", "value": "T12EA3024DD8E17C59C9E1A8BEC19A28F25638014D2886FF2F397D05B50B2618FD78B53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637770398, "uuid": "e4e4d4f3-67da-4c26-99d8-14855ca49c1d", "value": "3072:VNFzIsj8aipSW4vHREQ4iZKUbmz3By+hE4gd8:yOipmvxpZQbBhhQd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637770398, "uuid": "7a1b5ce0-4848-43c1-93d6-83139157cf32", "value": 101651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637770398, "uuid": "6f02e6f1-c1a8-4f7c-8a1d-a5c8eb7ed412", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637770398, "uuid": "d60658fd-d767-4f78-8ad9-5880af2a87b4", "value": "_2070731.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbc252e-4d21-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637756597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756597, "uuid": "688f163c-ac5d-4c9a-bdb7-eca155ca7180", "comment": "Malware payload (AgentTesla)", "value": "f87fef281717260b7a2fe25f5f2f52df", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756597, "uuid": "851277be-b353-4432-a68d-2ecb31355716", "comment": "Malware payload (AgentTesla)", "value": "111b4efaf87072cb13a37436b9356b7f9669f704fc4793246fb0567f6e66e4f0", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756597, "uuid": "d7f42363-2c6a-44fe-9773-fa90bf2aa85f", "comment": "Malware payload (AgentTesla)", "value": "387d9f5e9a0d0cdb8b1f1f1c9d594fdd3de32db0", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756597, "uuid": "56896b19-dab1-4e2e-b45c-81fe805a5b08", "comment": "Malware payload (AgentTesla)", "value": "46fb6863d641041bc8f1e7073b08ef879d814b3106e73d7a43c019846a99fead25c06751cc4fa534da5b4a72c23a3b27", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756597, "uuid": "08834c1d-35a5-4714-b621-dec7d19d5ff6", "value": "T1405423C8770BBCFAF2B0226F43FB26AD04578984F5E130132E59397D6681629B48B577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756597, "uuid": "0d4b717e-60d0-4da5-bc0f-e40b465ae0c3", "value": "6144:4wDrFFWerC7yS0OU/xpSfZcMgxKVuwQb/LhO3pKvoi88V6y:fFYeCuSy/xpSfeMgxMlILVFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756597, "uuid": "db147164-3e7f-4d27-a632-aa96323a3098", "value": 293792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756597, "uuid": "9a915ab9-9a20-4e4a-82f4-291052e219bc", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756597, "uuid": "d19ed6f4-8366-49ea-b9de-6b997488607e", "value": "originalcopy24112021.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce85edf5-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637763685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763685, "uuid": "fb587c08-42b0-4f25-990a-26be3310d470", "comment": "Malware payload (Dridex)", "value": "a5a3f1dfc67910d8afe518b74f8ee835", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763685, "uuid": "2d2a1421-b05f-43b3-b12d-3388c7c953f0", "comment": "Malware payload (Dridex)", "value": "115e3c2177c76253b064e00119b5f0fc94113ed7a8887d2b4726144fb264c564", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763685, "uuid": "bc243dd9-45a3-47a5-b24a-16233c904355", "comment": "Malware payload (Dridex)", "value": "c1f1766f5c4d3f4edc330e92e1313e851ee3c32b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763685, "uuid": "ba71fcd3-ce65-4a22-85bb-7be753172b68", "comment": "Malware payload (Dridex)", "value": "a8ab4a8015cb53eef10699c776df553e4793e3f5d61edc5a80d0d93ee3cb4e07d21f9e78b33816addbe8eb6f37224d71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763685, "uuid": "4a34afeb-caab-4955-9a5d-13e468592ebc", "value": "T11E6302ACD0E8A068CE59F0BEB05A1DF6645D9841F184E27F1C9DAF1865B234BAF0F135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763685, "uuid": "08f3f02d-f45e-454d-b2e4-a1f5995f03b6", "value": "1536:UWSpPFwJpvc1e+BwT8YIbDMz+1d6xm9jRjJmjmwAjYBgdUB:VSGMrbDu+1d6xWLmjwEBgdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763685, "uuid": "9cd37b38-7acf-48e5-a76a-1f69ab4e402d", "value": 69799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763685, "uuid": "d84b3238-9ccf-452d-b966-fd3225ed617f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763685, "uuid": "7d050121-cbe5-49e6-bdbe-461a6d882a70", "value": "subscription60547.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9120a5-4cf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637736813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736813, "uuid": "d7e38f4a-9c07-482b-8584-5b0bfc0859f7", "comment": "Malware payload (Formbook)", "value": "21d770333dc1d5121b6d02378cb79978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736813, "uuid": "d6d91f53-643b-4539-bc71-986258cd5840", "comment": "Malware payload (Formbook)", "value": "11710269a6869906c57073757a1f8b003f36a4ba25c1096dc400b20a2f1a0e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736813, "uuid": "9cb608df-019b-4e0d-a448-88bf2fd4b6df", "comment": "Malware payload (Formbook)", "value": "ef10226840c7c1c970ddf70e72c0ada37bbf236a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736813, "uuid": "03ca4839-ce2c-4536-a7bb-a67ef3fdad26", "comment": "Malware payload (Formbook)", "value": "93e8f3dd1c4c9cb3ccc9dd9b1dcafd9fee3b2225cd9f38f254b945c8a3d028594701cab05401775fc342a6cedd08fdc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736813, "uuid": "5c4b1cbf-77b8-4e3e-843c-cec8ca123c93", "value": "T1A164234EAEC09573C781C03726B843FB6BF582D6165A058B6FE12F9A1A3364398076D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736813, "uuid": "c1129a4d-7bf4-42d5-9247-cc11af487183", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736813, "uuid": "7e40b250-93bc-4e0f-833e-a756501ddc34", "value": "6144:rGiU105si+30g6mG5dD43qbBXPVpLHhXWQKdZp/oakRWRXp5YP8n7JYbQ:M0t+Eg8D43qbdPzHhXWQKhoakRW9wO9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736813, "uuid": "9db8368c-2324-4af6-903c-4f90c8530d83", "value": 319339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736813, "uuid": "b9887881-4291-4bfc-8847-8f4c7a5ed4ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736813, "uuid": "0dd0d729-3db7-43bd-9edb-457c6abcb6a0", "value": "Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324bd0b2-4d60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637783609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783609, "uuid": "e1ecf420-dce9-4a1a-b408-6c762d980b4a", "comment": "Malware payload", "value": "fc70f9cccfa80256fb794fb7699e85fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783609, "uuid": "85e85827-6d73-408d-a988-9d2071e4c4f4", "comment": "Malware payload", "value": "11f6520318927ff3c8c92f562fc90030117945c74bc02643701950545d9ecf71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783609, "uuid": "0c497c33-e92f-40be-97c2-1eeea49b2f33", "comment": "Malware payload", "value": "453140b612218ea078279798ad2093801ed34faf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783609, "uuid": "e727e7b5-05b2-44fc-82ea-67cb65a74c3d", "comment": "Malware payload", "value": "eb3f390afc5640f4e6f356eb9c3dacddf4b0cc42635e41a92b084f383b772be6be319dee08af4ecca1217b97f1d6ade5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783609, "uuid": "fe54d4a2-a3ea-469b-bd28-988720b4794f", "value": "T1D0C401553398B7A3CC7A0BF50C73D0C1137365167950EA2EACC961DE2E2AB145B22BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783609, "uuid": "d04a94ab-2515-4383-bdce-7f1669b5bacb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783609, "uuid": "a6e54181-328b-407c-9a50-11d5cf26e64b", "value": "12288:7tD00lov2yZc+wRd94e/2nngWyLQh7/tlq7LZQOKgQKxdwG7jFil:7C02uyZzwR3OnJeQhutQzqxjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637783609, "uuid": "08387d62-9f8b-4e2b-a0e4-fe67a7311b5e", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637783609, "uuid": "e17b1e48-0d67-409d-a3ad-4903b66795da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783609, "uuid": "3b43a2e7-dcff-4879-bd36-88fc62726ba9", "value": "fc70f9cccfa80256fb794fb7699e85fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3853f6-4d00-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637742500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742500, "uuid": "cd1a7b93-8bf3-4f55-b1df-26842a4448c1", "comment": "Malware payload (Formbook)", "value": "caabcfefe2ab0671500ae641942b66f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742500, "uuid": "31dd1c16-0d16-4ea8-9883-52ed58fbef95", "comment": "Malware payload (Formbook)", "value": "12aca5a1a2a02d088265af6659e98ce150298ee1a1c82bacff46df6fad9294a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742500, "uuid": "f785ed20-f9c1-4de3-a3c7-fd0bb4fd6ff2", "comment": "Malware payload (Formbook)", "value": "f3a712595fec1c2343a63ea7322bc066da3df64e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742500, "uuid": "d0e7d161-a764-47ad-9926-29b307488443", "comment": "Malware payload (Formbook)", "value": "045d36c8670ced6e16448fea654df2e102e42b52b8b9ded64d7fb1974f1da163632fd0cb4e605707a49cb61c25b592e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742500, "uuid": "4ceca6ca-e610-40a8-b9ad-53af8d69b05d", "value": "T13CB4022032A4A172C9BA8F772D2110C02BB1B6556E20EF5F7DC9034E795AB994B33777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742500, "uuid": "560de2f8-f294-4f82-a7d0-b7c1bbc897dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742500, "uuid": "12ee4267-0ade-49cd-b0b5-416e77c26010", "value": "12288:xUwQMlVOIQ/BntPWoem4HUYJaJdvSVOCnbX9YnDt3DSgoHHDPg:xK2fMBnUhQiaJdvSMmM16n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742500, "uuid": "cd4ba090-be44-46aa-ad45-f259a70f7dbf", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742500, "uuid": "facc834b-f7da-4cf0-88ec-e5654f7595e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742500, "uuid": "00222a96-e2d0-4d24-97c9-d315809d624b", "value": "RFP TENDER PABRIK KATALIS NASIONAL - PT KSI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1920bf2f-4cf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637736752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736752, "uuid": "16d4ee69-0ca9-4923-a3bb-9c70a4240b90", "comment": "Malware payload (Formbook)", "value": "cf4239a28ed12918e512f4ef7f555d70", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736752, "uuid": "95175b88-1e40-46c1-aee3-826360a630f0", "comment": "Malware payload (Formbook)", "value": "12d045a8a8bc0327883b89752c5b33908492a96d7e0f9d5408447771e11af177", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736752, "uuid": "80777755-6c21-4fe4-bd8c-600ca106f799", "comment": "Malware payload (Formbook)", "value": "ff1c1c1953bdb37ba9a838e0fd9470ac1c439eae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736752, "uuid": "a989ecff-cb2d-4d19-a98e-dbf18f11cd08", "comment": "Malware payload (Formbook)", "value": "fd8228bab9a9faab7401ecb7efdc6baafac517776b371fa2eac746e5124626ccfa89a27b662c4d5e6e1028b67909f6a8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736752, "uuid": "55eb5734-62e0-48fd-b6fe-65e874bfd101", "value": "T1723412D63328EC1DC3B6B2B34E6B8143DA90DE0AEC93B44A1545375BE57C2D3950A27B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736752, "uuid": "c9fa1bef-405e-4dd7-9510-435eb5de11d2", "value": "3072:AJD4ELRtL+jjDeiWS2R+D057DQQStj58SQdjOPxdnnFJA1EP0gF/i0xHZquZdcWb:AJ4OtWjDgACH2N58fcMgF/iSHTPTn5Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736752, "uuid": "43f7fb91-e89e-42e8-acfe-e9eab1e5b7d2", "value": 234408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736752, "uuid": "a2511b54-96da-4b6e-82c4-a4283d00986b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736752, "uuid": "a4683b16-6366-4f2d-8d2a-ddaa6acf9c3e", "value": "20211122164728974 -nn docs - mascot.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f76fe33-4d61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637783980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783980, "uuid": "fc595937-56d3-4750-88ed-f69cb80dfaad", "comment": "Malware payload", "value": "586f7a1895ea47a462b1d5f6a43fcd33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783980, "uuid": "bd993c23-5675-4713-806d-289e632095f9", "comment": "Malware payload", "value": "1358d88e078f1c59b546256968179bf213928f1e6f4e7afa255681b2cd8f92a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783980, "uuid": "d3934301-4169-4f5b-8661-578f4bb68b6f", "comment": "Malware payload", "value": "c41cd420af421d31faede9294af1a2edc638d543", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783980, "uuid": "7930c695-1a20-417d-8448-aa41c66b165b", "comment": "Malware payload", "value": "d8f755865f42dce10f7b1ab829a1b57aab8e0d70e67fa9f44398b6b35bf4803da4b96febd9dbf1fc8736a3061b2965e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783980, "uuid": "d2c0bfcf-f4b4-40f8-b57a-5bfbfc81de92", "value": "T18B64120ADEDC89F2E10114B40D3A727B7B72F5B621941D234F653C9E2A231126D779EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783980, "uuid": "e62efe65-609e-44a3-a912-dfbbaa599601", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783980, "uuid": "6d6e85eb-f4c5-4c9b-a84a-4a8e08553a84", "value": "6144:zGioDPSXaHJlpCAfHAFeuvM+OINyTm6n+gJfDjb9eLuQY1s:QPSKrpTHAFPPy0mDjb9e/Y1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637783980, "uuid": "d660257a-9aff-494e-ab33-0d48e79695a7", "value": 316854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637783980, "uuid": "0de08de4-7cc8-4e2b-8aa3-71aeadc4c00a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783980, "uuid": "0e76b762-67e7-4124-a303-5559e8b53666", "value": "586f7a1895ea47a462b1d5f6a43fcd33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b4da1a-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637776204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776204, "uuid": "f3c082c4-9c6d-40b6-8806-b570d8e789c7", "comment": "Malware payload (Mirai)", "value": "450da41834710040473bedc493bb1d04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776204, "uuid": "697df092-a49b-4c1d-ade1-563929b5e1b9", "comment": "Malware payload (Mirai)", "value": "16a6f4b11093ba9e60ed152eae22b5c2452c5d9b64dd19b454bfaf77a8c508a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776204, "uuid": "d8b969cb-1ed8-4f45-9d11-825b5b07c91d", "comment": "Malware payload (Mirai)", "value": "1b7cb33c59fbd529278418efc7fdef4e2c98f145", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776204, "uuid": "c5816f70-472c-4881-98fb-76c5866b2714", "comment": "Malware payload (Mirai)", "value": "f421118156b2ca259dd36691c03c1b58a3dcb62f69c333bb927bc1d8033a66ee3a9e93e2f96dda735007d1136925f1f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776204, "uuid": "107dfcc1-356b-4efd-ad9a-2bc7655ffe9c", "value": "T173B2E199D6EA1BC3C2A19336E0BC4A5DE1B61AC10346450A210DB24EB7D664E87FB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776204, "uuid": "0cd52811-0110-4fcc-91c5-15547b30d9e4", "value": "384:M8DKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLv:R/QOC0Yhn6ROHWFlAcwNEFCnNBxc6c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776204, "uuid": "72abc933-82ce-4930-8425-8c9354228e31", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776204, "uuid": "96be2bb2-0b47-461b-ab7e-96d806ecc653", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776204, "uuid": "ecea402c-6347-4dc6-8eb7-8835807d6a0a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df24c472-4cf6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637738373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738373, "uuid": "b0e1af2b-56e9-4193-af96-020e6e3e93b0", "comment": "Malware payload (AgentTesla)", "value": "264b0f1fabdbaef71e6f93097ba5c285", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738373, "uuid": "c099c19a-71dd-4ea9-beb8-b27ac67adfdd", "comment": "Malware payload (AgentTesla)", "value": "176923674427194da61b6a637e9682cf0105dbde1f7f4438c433cef7379a445f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738373, "uuid": "4dd7c282-93b5-4d8c-987f-d3a67669a79d", "comment": "Malware payload (AgentTesla)", "value": "942489fccfa656a39c2c1d9ea796d21d1cd9b377", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738373, "uuid": "0e47ad50-a78c-4f03-a863-bfdedddeb8ed", "comment": "Malware payload (AgentTesla)", "value": "f70a6a828e9af83fd1ee680c6479ee89126a6dee51b7d3d0bdf918d05b6b4c9d6bcf3e7df0cf558471a2913a8e768695", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738373, "uuid": "ba8504b6-528c-460b-acf8-c8967620425f", "value": "T171B4236D8FB2E700C4A701A97A0788F6EC8065A17C27DDF00569574FD3EE57F96EA880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738373, "uuid": "c552bc23-5336-4589-a0b2-7a20860ede82", "value": "12288:A9lX/TvtxDjDhDJwpaQPa62tLUgylXRCoxpSpIhOkGiy:aDr3hDJwpP+do60O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637738373, "uuid": "9af3e632-2f82-41aa-bc9b-58040865eecc", "value": 527307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637738373, "uuid": "27e2e6cb-c1d1-42cb-bcf2-56a72c37c182", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738373, "uuid": "451612b0-66e1-40c0-8abc-899d998fd98f", "value": "Freight Charges.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae377b7-4d68-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637787006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787006, "uuid": "9f368159-e7c1-4f60-aa5c-fce74badfd44", "comment": "Malware payload (Mirai)", "value": "1ee46d462290d1df40fed532a7eff2d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787006, "uuid": "80de3373-7082-4f9d-aecb-c938814cc408", "comment": "Malware payload (Mirai)", "value": "17719085e52e59061f84fb561b7955f37d1543ed7e68faab040ed6d1ebb63e54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787006, "uuid": "1735b08d-28ff-4c96-bd36-16229c866332", "comment": "Malware payload (Mirai)", "value": "0040bc5d2247da89b99d33920b6fd4f512b3f65b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787006, "uuid": "ff6e6df7-50d2-436b-931e-70868a6f9dc5", "comment": "Malware payload (Mirai)", "value": "b25ca727246092aad868d87dca13077f1368b643b5b5f14fcf4f3822b6cc7b135f0b1aa7ae30c844208e38fc9b7dc4cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787006, "uuid": "ba7328b8-a1c7-4a12-ba24-3987f33c144c", "value": "T13E534AC0A583D9F5EC110A743176EF329A77F03F3119DA87E3DA9963AA41E02D5072AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787006, "uuid": "9f29a58a-e365-43ab-8ea4-666d5719f145", "value": "1536:Lihj6+q2YDjeRIt0sXewx8zzpUpJxX+6Pg/+vSwu6bKT8R:LiJ6+5YveeLXewx8zG5X+6I/+vFqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637787006, "uuid": "dfb38ae1-b186-45f6-82ac-c683d3aa17c2", "value": 62256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637787006, "uuid": "32033ea1-809d-4935-8079-7059c9bc6d92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787006, "uuid": "9e8b0760-34a5-4db1-975a-f8078f487a03", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008e58ea-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744442, "uuid": "712890e3-d13b-412b-a06c-e8fa5f18181a", "comment": "Malware payload", "value": "8765691f5aa369c645ae9d0f3e78f9b0", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744442, "uuid": "2cbd2093-47dc-44a9-9ac9-a1f91a30b4cb", "comment": "Malware payload", "value": "18bd041bc941cabf8302995a602d64c8e22313616359c05e56e228e261880ef5", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744442, "uuid": "40212bcd-3d6e-492f-a660-0009df43bebe", "comment": "Malware payload", "value": "397d7f0040d39b05755343b058f648dfacc3d489", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744442, "uuid": "51561730-db8c-4bf0-bee5-6b5487718dd0", "comment": "Malware payload", "value": "5548bab2e7995c862e51fee6a0b15eed1e6aa3cb294781fd12cc5be418313109e52aa5ce9a8ffef21c386956c87bec87", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744442, "uuid": "35911f91-d807-47d6-8605-729859954117", "value": "T13CB5330C1275BCFDFC5E422927638ED0C2B9B2E4F5426191926848A85D3F5BE13EF972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744442, "uuid": "cf4587fe-6856-41d8-b67f-d0b76e6ae4ab", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lfprl:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744442, "uuid": "fda4fe67-30bf-46c7-a3a4-1eb18c7522f1", "value": 2355200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744442, "uuid": "ec95ca8a-6bd6-4e4e-8248-739c2841ee45", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744442, "uuid": "9d002a4c-11a6-44e0-928b-125c2dcd5653", "value": "18bd041bc941cabf8302995a602d64c8e22313616359c05e56e228e261880ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b73a283-4cc7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637718019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718019, "uuid": "956068e7-63c9-41b8-89a1-43f88639946a", "comment": "Malware payload (RedLineStealer)", "value": "6cc26551fed4831f520dd19d387ac05b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718019, "uuid": "73171086-e7ba-407a-82f8-bed2bba27fd4", "comment": "Malware payload (RedLineStealer)", "value": "18e66b7b0a955073e30de2f323854bf3fe83798ba1cbeaf552a15b919ca5374d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718019, "uuid": "48717787-3107-4233-af03-aeb05bb7dba0", "comment": "Malware payload (RedLineStealer)", "value": "3e7c359b68addb53bd7d8ce63be1f32732c8d39d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718019, "uuid": "73b11cac-6929-4788-a5d4-7e5807cdbb4d", "comment": "Malware payload (RedLineStealer)", "value": "6e676e76e8a03c5c311aa49effadfe3c61c172ba579db3a21aa9342fbfbe50b08c56d1aab11b8ca9abb9bacdee4330fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718019, "uuid": "399a9812-f465-460d-8377-6881774f7e83", "value": "T1C654F1D1B6B19032D0D226352431CBA05E3E7D32697040CBE7987B2E6E7D7D14BAA74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718019, "uuid": "efef5a3a-2767-4ef8-957b-679deff463b0", "value": "4266e36aeae4bf1789c82b3b7f7f3122", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718019, "uuid": "64898943-4206-48fc-a8e9-b3670ef7887a", "value": "6144:xRL6G9fz31znezOOUdwDbeDCHqxrlYafMQRAv93yHaTzzyt:xd6G9fb1syse+HqY8RA1C6/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637718019, "uuid": "f0e1d607-c6c0-4e30-8645-9bde6f52c3c5", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637718019, "uuid": "f128cbcd-a209-4c8c-ac95-37c9b55741d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718019, "uuid": "ad338bd9-9914-4264-bc6d-25e90b29d6b2", "value": "6cc26551fed4831f520dd19d387ac05b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e22018-4d32-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637763806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763806, "uuid": "e2764a78-4b97-411a-be48-9c4d979fb168", "comment": "Malware payload (AgentTesla)", "value": "a137de9043f3eefa082726b4228f11d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763806, "uuid": "8fadb07b-f156-45a7-88e3-c72e4672aa33", "comment": "Malware payload (AgentTesla)", "value": "195d15fb701a756f1e2dcb9f626d074db044957f6aa104d762761e956336c25a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763806, "uuid": "74260992-621d-4e55-a6ec-e0922d167081", "comment": "Malware payload (AgentTesla)", "value": "8e3a9d7ea0838750ff4f9f4afd9cd46c275ad514", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763806, "uuid": "20618e3d-db72-45da-a96c-d6dc4d27420f", "comment": "Malware payload (AgentTesla)", "value": "ab74fa8259b71d342630ad79e6b94000f18d6cc245cfc7e89087acd69891ce18837fe4598510e069e16fc628799e245f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763806, "uuid": "db62df08-bef0-4c62-812e-bbe046c6a119", "value": "T13CC412613295D122C8760FB70C31208013B2BD552911DB9FBDD97A4F3D3BB9A4B21BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763806, "uuid": "84279c9a-1ea7-4f3a-bf99-9794f0c4dd9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763806, "uuid": "c514a393-ee77-4718-b142-efba3b236522", "value": "12288:XgJDvVwm1tv9ingQORz9HwgWEeiXPDdcG/MqzeZBS4T4myh3tcKh4x9y1:X41Zog9z9HwDEeiXPJ0qz8nJRhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763806, "uuid": "148a501e-5267-487a-bb2f-e1900b01afe8", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763806, "uuid": "66f336ba-9567-47ff-9e84-1224c272b49d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763806, "uuid": "8ae334ca-0608-480c-bdb6-5c45a941c652", "value": "NEW PURCHASE ORDER,PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc52d8c-4cca-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637719204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719204, "uuid": "c165fcd3-a302-4f93-a9ef-30430f448662", "comment": "Malware payload (Mirai)", "value": "b4c208f3f954a2a0ab4f6cf90ef2b10f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719204, "uuid": "d5797fe0-75f5-462e-9ab8-1ef1701d2775", "comment": "Malware payload (Mirai)", "value": "1983bdf086f08137c6b478bbd2eff11f4e5dc33e8440c1833dd02ddec5f54fb3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719204, "uuid": "573a6339-2955-4c91-b7f8-1f968696a662", "comment": "Malware payload (Mirai)", "value": "97f9e9bd91789869e486941e9f49e8fa691e4796", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719204, "uuid": "5ffb83d8-15b5-4c5c-b302-56173b1e51a8", "comment": "Malware payload (Mirai)", "value": "d4b44d567d352d14ad2956a4d83fa7b03eea64f5b9e652a4cd479daf3503ac3a6b3e7b278641bb5ed71c2c8c57e86ac7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719204, "uuid": "658503af-0b55-4238-85e2-5b772e4e02db", "value": "T165532AC8E5D3E8F5DC1409B8306ABB65AEB3F13B7035E99BC3D82573A901702D5066AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719204, "uuid": "f0d976a5-4b6c-4b2f-8009-c72beacbd34b", "value": "1536:+yh46QWtBrYQPNseLL337/iO+SWuX/MMOCs2qg6U4e:v46QWtBrYQPNsef7iJSWs/dOC3qR9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637719204, "uuid": "8becb504-7254-4306-8e8a-421e495f635c", "value": 66140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637719204, "uuid": "3eb50f73-7a42-4f0f-a98d-9da2c8375fbc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719204, "uuid": "454f4573-01a2-4350-927d-1da8c71d3a8b", "value": "jydygx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fe1184-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637774193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774193, "uuid": "b53b79f3-183a-4661-982f-4837b2b45f6e", "comment": "Malware payload (Dridex)", "value": "af37986b897322e6888efa0a4428c883", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774193, "uuid": "667927ae-b644-402e-a8e5-e6779e44a36a", "comment": "Malware payload (Dridex)", "value": "19a8a28e3626a6d58fdc499b95c35cb9d7ec2ae4cdcefd3460d4b40b868d369b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774193, "uuid": "00f74e37-63f9-4f98-8b13-89b7c58e6724", "comment": "Malware payload (Dridex)", "value": "6f66fc6d8d4913b11e4982a50658eca42b42f98b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774193, "uuid": "f7298bf1-42c7-4dad-8f64-3530fdfe2ffd", "comment": "Malware payload (Dridex)", "value": "fe9831ba8c84a0a74f89cb9a8e2e91b0a79d48d32e65e9cc3abc20aca550e38748dcf20af5b45cf8a3525cceff918dee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774193, "uuid": "07ebb9e6-70db-46ff-bfdc-c08a0a864c31", "value": "T19363F2BDE0539C98C6ADF83EB42A0CF5D84B901272D5C26F2C5CBB48475229B9F4E139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774193, "uuid": "b59a2c7f-71d5-42f1-88c9-a2244e163f23", "value": "1536:UWoPFwJpvc1e+BwT8YIbDMz+1d6xqxE5yfGrS/fZ6/gdG/:VnMrbDu+1d6xq9GZ/gdG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774193, "uuid": "14288be3-b58f-408f-81bd-ff98d1e29c25", "value": 70100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774193, "uuid": "7d58540d-2d3f-47a2-801c-4f7b722e2e66", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774193, "uuid": "d83762b9-2f0b-4073-a73b-d0d780b48a2d", "value": "sale_voucher_83599.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690c506c-4d38-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637766521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766521, "uuid": "b46dbb24-13cc-47dc-bfc9-a5f27a86d7eb", "comment": "Malware payload", "value": "3ef93606bf881b3f8df095cef4c0c0a7", "object_relation": "md5", "Tag": [ { "name": "Squirrel Waffle", "colour": "#CE7551", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766521, "uuid": "5e26b56f-fda4-4ac3-95c1-e881c72807e3", "comment": "Malware payload", "value": "1a1c58e00e858234acf9cadb9a5252d825491b3862f61a08ea95a2347a7b523f", "object_relation": "sha256", "Tag": [ { "name": "Squirrel Waffle", "colour": "#CE7551", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766521, "uuid": "6a60d941-571e-485c-887b-98ab984ffeb3", "comment": "Malware payload", "value": "fecfdd8fa9508ee798623831cfc951faae435df4", "object_relation": "sha1", "Tag": [ { "name": "Squirrel Waffle", "colour": "#CE7551", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766521, "uuid": "e83e6783-1806-48b8-a163-b8a2f389194f", "comment": "Malware payload", "value": "b89e9e03373499ae717fc383e932021216b1707bf88a8bb7f95d11b0f3d8fa8df56ecfb0db0e42b51c3fece0203560e9", "object_relation": "sha3-384", "Tag": [ { "name": "Squirrel Waffle", "colour": "#CE7551", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766521, "uuid": "6d365956-edba-4be4-8b55-760709948d58", "value": "T19A1422D5CBD9139A94B0252CE7C77A32E439FA19E4FD32E0261E0E5554A1AC029B8F1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766521, "uuid": "3817be9f-cb86-4aa1-9300-a8841ef95f80", "value": "3072:OQHYf930UsWxw3CsYkUQMfI24KJ3zZ0OeN/qjSki3g8YJMvmV4ECre0vOq8c23Zt:FPWC5FUQMfIeZ0tN/q+ki3MrSOhM+Fqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637766521, "uuid": "99b29d87-45cf-4b95-83ce-3110461c9889", "value": 195125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637766521, "uuid": "ff08849e-201d-4ebe-8cee-e647f61480f7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766521, "uuid": "b17e9817-018e-41d2-b111-8f2b57ae1eef", "value": "inut-6693839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f38812-4d37-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637766271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766271, "uuid": "44a9205d-e6aa-440a-b29e-c66a9e8d89b9", "comment": "Malware payload", "value": "9bfb62e52e44f0a3472fdde316d557d0", "object_relation": "md5", "Tag": [ { "name": "Squirrel Waffle", "colour": "#CE7551", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766271, "uuid": "88dfe3db-2d49-467a-8736-a814c3ec7800", "comment": "Malware payload", "value": "1c47338d2e639f6a55f7a587b90ac7d323390f72bcf626b063214a7e2dcd5e1f", "object_relation": "sha256", "Tag": [ { "name": "Squirrel Waffle", "colour": "#CE7551", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766271, "uuid": "f174a3ef-796e-40f9-8290-a605191bf7f7", "comment": "Malware payload", "value": "3e1d4dd02d89350400cf93d58d87c6682d001b92", "object_relation": "sha1", "Tag": [ { "name": "Squirrel Waffle", "colour": "#CE7551", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766271, "uuid": "5108d5be-d208-4080-8484-edb6ee8f0988", "comment": "Malware payload", "value": "40264526eb0f4ecff4949304b4120ae4f7d50893c1d04423737322f8d0b38f598e9fe52399d3f7ea75dd9d0c762b0f5b", "object_relation": "sha3-384", "Tag": [ { "name": "Squirrel Waffle", "colour": "#CE7551", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766271, "uuid": "cd8fdefa-df0d-42d2-bea5-096aac636feb", "value": "T1401423D4CBC9125A54B0263CE7C77A32A425FA1CE8FD33E1271E4E5590A1DD025A8B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766271, "uuid": "50e1c38b-8347-497e-8119-90a6756b67c4", "value": "3072:UQHYf930UsWxw3CsYkUQMfI24KJ3zZ0OeN/qjSki3g8YJMvmV4ECre0vOq8c23Z0:/PWC5FUQMfIeZ0tN/q+ki3MrSOhM+Fq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637766271, "uuid": "b93708b6-b46c-4805-ae8e-17ed7d513f3d", "value": 195123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637766271, "uuid": "ca8310a2-fc83-42ab-9760-e0e225a3e553", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766271, "uuid": "342c45f6-f892-4d80-a3f8-bffb95e8520d", "value": "repellatrecusandae-6693839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8f626c-4d4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637775657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775657, "uuid": "4114cf2a-9a89-4ecf-9c9b-7171491939e3", "comment": "Malware payload (Formbook)", "value": "4d332f00dd2d63fb44febc2bb5b13809", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775657, "uuid": "925eeb54-3ed6-4288-88f9-9d1fe99b6a81", "comment": "Malware payload (Formbook)", "value": "1ce6939a2a14d23d0b62c13bec80ab93dba7667f867bb05b905476bdec9d5c33", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775657, "uuid": "cf322f78-c9d1-4c5b-abe6-73dd00ecf71e", "comment": "Malware payload (Formbook)", "value": "f1b47473d62614a72217c456b504cf2a2328b01b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775657, "uuid": "93fab881-48ee-4e21-bc06-1afec3e59244", "comment": "Malware payload (Formbook)", "value": "4f419adb8adbdadd9e0e7933da942a0763439c27a682981cf39a4e811efd47e52598aa41a943de6efb75bc663e693c34", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775657, "uuid": "92d6eb2c-7e50-485a-b289-e1858098078b", "value": "T19F922DBCD09341988F8667F8671B6F06108CB62EF788A532367CA7342BD6D7A501397C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775657, "uuid": "c1ff87e2-376b-4643-858e-4c07f496eeb3", "value": "384:JK+466hRFARWp9gIGsY43VfIDEKJs4U6xfXjSZ:paRFd9gL45IQKJ3bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775657, "uuid": "62cfa148-bd24-490d-9f80-32431b26959e", "value": 19590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775657, "uuid": "3d9c37a5-6ea3-4d31-887b-360e37d8eaec", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775657, "uuid": "7ec72d56-2316-45b9-940e-449f9dfb50f4", "value": "2020 year financial report.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ac5fd5-4d1d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637755027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637755027, "uuid": "a4237d20-e1d9-403a-942d-672794b87b15", "comment": "Malware payload", "value": "52c730b396e4e59406c8ac58eb99ff18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637755027, "uuid": "569a2ba3-ca18-40d1-a2ad-27ceb98791b0", "comment": "Malware payload", "value": "1d1af63ee7a2fb11cf7b8ed225a07c12341bfc84ef5604be87e635b2203e242e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637755027, "uuid": "c27701ae-643a-410c-b637-c079a3c48645", "comment": "Malware payload", "value": "7c9e0deb8542732a3290f35eaade4d52a7424919", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637755027, "uuid": "75eb4251-0541-493d-badd-09df47328833", "comment": "Malware payload", "value": "981b0a86fab8e6be747273516a837a13d0a2f9d565d49d1610245146975f181cc184f454f0e2e310ea9e8b57e5ff598d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637755027, "uuid": "5e071b91-6b75-4756-9521-0aca9c8b1d4d", "value": "T175741213E094307BC8E186BE960E1F56BE62A5D184FA1B38CE4CBB5672075678D0AF4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637755027, "uuid": "b294a3e0-f884-438f-8fd1-3c12f024cbc1", "value": "6144:Wr9Cvb+OC67iyE1wK+VpA8TueQYdZqnSgiORjvJPyrwYQysL06Ye:uiuwK+HA8TueQWZUHtvhyrwY2L06t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637755027, "uuid": "9a5b784f-a76f-47db-b819-2b0489801f5c", "value": 341525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637755027, "uuid": "e0b6a26f-692e-4e1e-81e2-67842b772d7f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637755027, "uuid": "2929238a-7e52-41ca-b2b1-c7db10c40a7f", "value": "CV O.G Erdogdu (latest update).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c472a8-4d23-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637757662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757662, "uuid": "020cfb4b-663c-4444-ad23-d1fcc0995d28", "comment": "Malware payload (Dridex)", "value": "a21cc04fca25b0497c91d8102a707dc0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757662, "uuid": "ab535dc3-8c8b-4d6d-acbb-03e4719c4dd4", "comment": "Malware payload (Dridex)", "value": "1dd54e8f4ab2fbd7e0fa375b519888ed7a65064ce1a05b17dd48764942c36efb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757662, "uuid": "c5a71bef-9bf0-487d-9bef-4408d92381ab", "comment": "Malware payload (Dridex)", "value": "d722495c22cec36322019030b24744b17af4163f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757662, "uuid": "96038979-f23d-4df3-87c4-4b3996db5eed", "comment": "Malware payload (Dridex)", "value": "8aa07f4e6ce706a5048cbe63aca5011a1bb1ca35118bb2ff1e2e3f4b6b38a4e872442c946d49b45f80d8f632103ad204", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757662, "uuid": "010115bb-bb8c-4676-9b7f-f69b4ef7b558", "value": "T1CD73F1EDC154E405E713DEBEC6AACCE5A3550992B640C55B24E9B20CADB73830BED06E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757662, "uuid": "ffa733e2-4450-4625-b2d8-960d49109c68", "value": "1536:UWTPuALLImemeKHqeK7YncVZtiv25Dbj9cwTE0Bw3DXgdQ:VK80XKUYe3wbgdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637757662, "uuid": "7eddc911-2850-4c14-84d4-95842995bf82", "value": 76939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637757662, "uuid": "ec8c438a-43ef-4333-adbb-8dac591354de", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757662, "uuid": "e3c10e1b-0981-4820-8581-f77d95c8147d", "value": "promo details 0396729.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761901a8-4d40-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637769979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769979, "uuid": "e7117cad-8db5-4eb6-abfc-2169611bbad8", "comment": "Malware payload (RedLineStealer)", "value": "01d49a3def76202fb2602173f5088ebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769979, "uuid": "8979114b-25e7-4fae-8853-b69a2431da7f", "comment": "Malware payload (RedLineStealer)", "value": "1e1f6506827ffebe66c5d67ed0596b6c9960260062fbb430a94994d52e83afd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769979, "uuid": "5038e037-0fca-46e1-85b1-d263ae0862c0", "comment": "Malware payload (RedLineStealer)", "value": "63610d7554752b9f6655af80d788c662b832accb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769979, "uuid": "3884194d-2f6a-4aea-a172-d6998a8a890b", "comment": "Malware payload (RedLineStealer)", "value": "5ada57e6d248b02f0b5a7ed78bf02c031251f0529754cc6ca8e262a3c7106d81e08952d17fb1429e61cd0ba6bafeff8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769979, "uuid": "00c31e3d-ea19-4e08-92a6-da6ff57d3a34", "value": "T11A65335BAB10200FC6CCDE7CAD5BFB17D40567AD2BC2A50603FC6D8E5A14256EB861F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769979, "uuid": "d9b357b8-84ac-47f7-a18b-d7d27b15d8ac", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769979, "uuid": "1922fdfd-03ca-4b63-a03f-76a9a10eee9e", "value": "24576:UccBqlKJUtbjD7/kZh1KJBglrygtWvsw5Iw8lxMoOQkEaHNYK3T7oy3NVzLH:UvBqlKmf3MZh1K2JRtW0w5Iw8lxMZQNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637769979, "uuid": "127da757-691a-475d-b662-e7860ced42b2", "value": 1543648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637769979, "uuid": "05225116-3618-4c60-a664-0063c3ef0de2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769979, "uuid": "6ab8ba5b-4eb1-4fda-915c-0079edd3d111", "value": "01d49a3def76202fb2602173f5088ebe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bcfd30-4d3a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637767370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637767370, "uuid": "197e39bc-1e75-4c29-95dd-1871400d47e0", "comment": "Malware payload (Formbook)", "value": "0a9ffe8ce69354161d878db40a8fba0b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637767370, "uuid": "040872b9-f51c-4e34-b6c7-49f6041814b9", "comment": "Malware payload (Formbook)", "value": "1ece7885fe760a31c785e4e59609fe0bb857d157fca64c13c9e2f8c0bf5655af", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637767370, "uuid": "f1019e10-aa05-4eb7-89e4-c407fd3cf128", "comment": "Malware payload (Formbook)", "value": "f63c63b0ad665f06c4c057e12576a79482875192", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637767370, "uuid": "5c2b1d02-4d5d-4e75-9d2e-4cc854de688e", "comment": "Malware payload (Formbook)", "value": "e0862c7e3259e7965093156e039c9d9f2329c924ca26e3e3d9b7d618bedb92b1c726e2b0f7d1cd5926bcc2d5c75468db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637767370, "uuid": "b6f2d25d-280b-4aa7-9954-a3e44f7ba417", "value": "T1D8341280B3C9BF9EDAF23DB8D0586CA2C924ECF7E83F1482F80A3D52613955857B1655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637767370, "uuid": "f11d7cf6-7c84-43de-a096-adfc99a69d1e", "value": "6144:mHrGmQQ77Esfci+uRi/04JPPA3LUCHXgtKgV:UcQPfcim/04JPPMUKgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637767370, "uuid": "8afa6665-0db5-444e-9a25-a944c5be2ffe", "value": 234440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637767370, "uuid": "0ab5457e-9fee-4def-84ef-36f7bd023fe6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637767370, "uuid": "bf117aaa-2491-4366-8543-74c4d9532529", "value": "Product Offerety44663573.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a470d066-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1637780365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780365, "uuid": "7ae56c07-ddca-4dd6-9bed-5747ff56f5ab", "comment": "Malware payload (Gozi)", "value": "f100bcf4531fa33e2dd85c321e40abff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780365, "uuid": "bb02f363-3cf2-4786-aaf3-c35964edf7cc", "comment": "Malware payload (Gozi)", "value": "1effa020a0b9aba59323d36d4c8680fa1bcd34f95e5b223b315053c08f4fb349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780365, "uuid": "8749e2b2-2714-4294-84e7-149aa66f398a", "comment": "Malware payload (Gozi)", "value": "0599268c78900d3f791b55f3e65401239f5b4309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780365, "uuid": "bd81cb46-0497-49d7-9372-aa5094ca0420", "comment": "Malware payload (Gozi)", "value": "999debda64309a790aa5a395bd2d15d7e449326733e883426e851dccc6bd13bd7a9c31dc79772056f32e74b2c02ddb49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780365, "uuid": "8d8e8a16-6185-470a-af73-9f90052b5067", "value": "T127F3BE2136E0B075D5A72D3378749BA61A76B8322671428F278C1E7F1F7D2D08AB4397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780365, "uuid": "acaeedf7-b4b9-4e0f-bc88-4335df680519", "value": "7fa5c9c2dffd615fa15cdafc116d6f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780365, "uuid": "9f4cae34-095c-4e7f-baea-ea270baa9ced", "value": "3072:TUeBMoaUoWnhoq/8OkUbZlB5qh0LYgt3MhhRuA9RUjST2:RB/aUoWayQUbDBpLRt3MhuKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780365, "uuid": "ebbec0cb-e0af-4b88-a3d7-dc0695866a4a", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780365, "uuid": "aaab6ee0-6ab0-4f44-b477-a1f8cf1c1069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780365, "uuid": "ca1e04fe-c7b3-4d3a-9cf3-6e6f09525e14", "value": "f100bcf4531fa33e2dd85c321e40abff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9456edfd-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637776043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776043, "uuid": "9819c855-ebfa-43a2-a988-f02cc72ccc19", "comment": "Malware payload (Formbook)", "value": "21961d65e20a150449488bc5d618de5d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776043, "uuid": "76f69ea7-9c9f-4126-8823-675c3d7165a8", "comment": "Malware payload (Formbook)", "value": "1f0286fc18913f4ff08874220b5e2b73adda7df4ef64c6b2b7757f32f4727965", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776043, "uuid": "24662e5a-1c96-4d30-b20c-545399a940a7", "comment": "Malware payload (Formbook)", "value": "8e5a7703618b637d87ec396034d7a492e642e28a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776043, "uuid": "854d11cb-9668-41f5-bb2b-422998444ca5", "comment": "Malware payload (Formbook)", "value": "26a5037154acbebb74d6cb72bfa6585e449e424969d9e823c01f48b3f1444a5d9b2717e5796631835e3244bdd37e4ad7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776043, "uuid": "ffef5a12-9a89-405f-a534-f6b84b25a5eb", "value": "T1B93412107B900E6EC1DB19797A91E9492F3BEE379A4A718ED94074435FB90328E33397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776043, "uuid": "f40d9f8e-001b-4acc-97e5-d7c27d6b9b31", "value": "6144:mfAnsT+Td6fzwls7RVbIpE6Hs2jrfOMEfVybUkRyny2:mHTudo33IxH1j1bYy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776043, "uuid": "bdc0c837-944a-48bc-88b0-873842c6eb50", "value": 234344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776043, "uuid": "04e1120f-104e-4417-aa41-0823b31a3def", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776043, "uuid": "dad9a878-c73c-4962-a9fb-4f30a3efa075", "value": "Quote Request - Linde Tunisia.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0b1492-4d25-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637758497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758497, "uuid": "e028dfc5-8ef6-4182-a986-bf924ed4826d", "comment": "Malware payload (RedLineStealer)", "value": "1ebf93a11a067025a7ef0ce66740e7c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758497, "uuid": "bf4450f5-7321-4138-bdf1-b926448db2ec", "comment": "Malware payload (RedLineStealer)", "value": "1fb4024a5d9db5517e6c96921d1d32e224981aa3558b8a7bde1e9c2cd07f36db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758497, "uuid": "a508044f-62a7-408e-a6b5-76f6fa8c6652", "comment": "Malware payload (RedLineStealer)", "value": "3cbc66ab5d6c7627ba21c3c8c2762a55ddcfdaaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758497, "uuid": "8f0da2c8-6aee-4bc8-b8fe-5bd43b9df884", "comment": "Malware payload (RedLineStealer)", "value": "d4362858273761c5258d2fc24925cd9e769410d0de32995dde082f666cb448f07596d0152a26c904b62a6d63d378ea1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758497, "uuid": "475268f6-f17f-4bd3-8578-02163188a910", "value": "T1C055338387813EA2F3440B3C7D7686E7BF438D116ED9908DD24BA6D44B048667F6B1B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758497, "uuid": "2a929e0e-1cf3-46ae-b626-b38efaee6086", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758497, "uuid": "87d7ae0b-a8a1-4d9e-bd22-4a272b326aa2", "value": "24576:4eUipcPOLIhp+yhNXek4lY6XnEdEeb0iBKcB9MkEaHNYK3GIpz4bjm:hVpcPIIhsYiEdPgcwNaMg4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758497, "uuid": "3c909452-447f-442b-9b0b-2ddb81580d29", "value": 1314432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758497, "uuid": "a36bb58f-7c42-4399-82c9-a5c1e5decfb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758497, "uuid": "7f0a1ae9-c2df-4b86-b505-dc6a1df52445", "value": "1ebf93a11a067025a7ef0ce66740e7c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9add5c9a-4cff-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637742124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742124, "uuid": "63353cb9-bbfd-45e3-8eb3-c5ae011de847", "comment": "Malware payload (ArkeiStealer)", "value": "49daa197ba9d35b6427619d11eacb02d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742124, "uuid": "a3c74a17-92fc-484a-89b3-6eada16ffefa", "comment": "Malware payload (ArkeiStealer)", "value": "202419d4bb371f89f51ff4dcce7bd5c1a4558f74e5615ce050928ab5bbe52a48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742124, "uuid": "5f87c1dc-4e4a-4cc6-98ae-ea255c6896d1", "comment": "Malware payload (ArkeiStealer)", "value": "0f5b3c39f62abe6d1bdfb90598b31fc0c39e80b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742124, "uuid": "cf82fd79-a105-4093-9a04-e831e747786a", "comment": "Malware payload (ArkeiStealer)", "value": "bc10a195dd54799d5d51d3078c6996b8de2184bb18d65821b3ef92150fe73ef69507dc4498bd1d393b871d3d42239d01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742124, "uuid": "aefe67c5-8f9c-469c-bb7c-695c938f7027", "value": "T10214CF2131E1D472C2AB5932B8B1D9611A7BF8736B70814B37982F2A1F71FD25639393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742124, "uuid": "2e6ecaa5-3cfe-434e-8abe-36abedbb1334", "value": "78c8430db0cbfbd938307d41d500bf50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742124, "uuid": "616b0059-2585-4341-be9a-84963787a05b", "value": "6144:OH3Mp8x+D+cLSRAkPCGuezuGulTuIzfv:OXE8xFccAkn7zPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742124, "uuid": "ed453283-25ba-454c-9b43-9815ab7444c2", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742124, "uuid": "74278534-bc84-40c2-92a4-df15c1a67fc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742124, "uuid": "d2903df0-dc54-4311-a272-888f031cbf13", "value": "49daa197ba9d35b6427619d11eacb02d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ce8144-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744444, "uuid": "ddba0166-0b50-48d5-94ab-bf59ffdea443", "comment": "Malware payload", "value": "f9499282d0ca31c5b604314e477dba6d", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744444, "uuid": "4af2a285-6a57-4dfc-b7b3-5a824835cf7a", "comment": "Malware payload", "value": "2026540aff660b37438fba47384c60c985fb3213a52eab668beaabea0c1081bb", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744444, "uuid": "80f68347-f4c4-4c2e-a290-2b7ebae49576", "comment": "Malware payload", "value": "8e83d09642cd0fd9def8a249b24340c17c6578fd", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744444, "uuid": "a9f41680-488b-478e-93d8-721837b1f0a3", "comment": "Malware payload", "value": "84f39df5cbbf4afcadac94223a3ddd688b9e97b833a802983a209aae5f5d1321c14290418713a6a8ef83ffb09ae91d66", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744444, "uuid": "7d98dacc-0ffd-4180-8e80-8144eb4035ac", "value": "T14AE533794E3B68C7503D2716985683F39621BCEE1C28F015E3FE96DD348E5F498C2AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744444, "uuid": "38b14524-654d-4489-8b8e-914f9804ba97", "value": "98304:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKR7O4gLtubex6E6H7Ycp+:R4FEQETHt3/b2TdR7Xgqo6F3p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744444, "uuid": "93353433-53df-4629-9ffe-a157303f05f5", "value": 3317760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744444, "uuid": "f589984f-4115-46ca-8075-0771aded982e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744444, "uuid": "0b4dab7f-0e5f-468c-ba45-5af785504c67", "value": "2026540aff660b37438fba47384c60c985fb3213a52eab668beaabea0c1081bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5cccc0-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637774390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774390, "uuid": "34ab41ec-ca5c-4dba-9c53-688c121a1b49", "comment": "Malware payload", "value": "6b2f3a3e47712c9f7836c1b962f1b114", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774390, "uuid": "2daaf6f7-05ff-48ee-ad20-897b27027d8b", "comment": "Malware payload", "value": "20471d885861c8597f6e8b59e09c176870fc2bb647fde63a8c36874fe03f7304", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774390, "uuid": "1cee2470-911e-4237-8385-112ea9e6036c", "comment": "Malware payload", "value": "206d25a9debfd35610249a0076462c717c9d26e5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774390, "uuid": "ad6347a9-a0a3-413a-a0d3-c70d01a04999", "comment": "Malware payload", "value": "9f178ec920667bbb5eee49ad97bef00f9198f89e72a4cf17ae367b7193f6e3b96f79db1b82eda154e72fb65b74017d0f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774390, "uuid": "916843e3-45f8-43ff-a22b-c6e8ed648bdd", "value": "T1B695158303452BA8F38D0FC88AA6B4171CF2D4567C64155CE7BF69EFAC2BEC81474669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774390, "uuid": "4a6d532c-0fc7-42ee-beca-b02577d79197", "value": "1536:08GZjbVVKi/nPRDcJXdauB/shOdeOl+EOf5Mr85ytZYJWDDjGd0IR/a6UusQSoZ4:gVg8WyiztavAuO3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774390, "uuid": "f15c80c6-5018-4d80-aa08-84af56093ba6", "value": 1949145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774390, "uuid": "f87579dd-65fd-4a48-8586-d2135f38734b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774390, "uuid": "28f0d3f2-b5f2-4619-8ad1-23591e0e2fe5", "value": "F.A.Q[2021.11.23_19-17].vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662787ee-4d23-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637757497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757497, "uuid": "e354bf72-bdbf-43dc-a74a-d52e879d0dd2", "comment": "Malware payload (Loki)", "value": "09503fb68d55becbcbf719c91031c316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757497, "uuid": "1907f763-5f3a-40e1-b2b2-7856d3a60b15", "comment": "Malware payload (Loki)", "value": "20f6b3ec82a38812ac8132027109063550531fbc95a410198a15259282737753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757497, "uuid": "a1e39e59-861c-437b-a943-d4a81b90193f", "comment": "Malware payload (Loki)", "value": "2b173bd9d383abad87a197ba67bffb95e1e73314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757497, "uuid": "79d4547a-e707-4afe-a570-59925500a374", "comment": "Malware payload (Loki)", "value": "2712f586f09aaa56c0b8affca7e3d0332ec25f7bb1e3531177d1ddae33efe43a949eee819ba2fe0060a5b29db31446ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757497, "uuid": "ee567bee-f6da-48ec-ba09-5150883e379d", "value": "T12ED40806BECAEC05E9D997FD8DB35F358E5DB5EA481042BAB388762D50263741FC8207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757497, "uuid": "5429d088-ba51-4746-9629-48e97ff0fb1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757497, "uuid": "09269e2c-9020-470a-847c-e075e3bf2fce", "value": "12288:z0HLQ3+34tJvcTWSzcEnXjOB/wJFvr3lKvECY78V3YxpRg3qOCbs1C3EChbv/nUo:zsK+InkT5w2TUwEjy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637757497, "uuid": "3481e3cc-bd90-4649-a356-f8e0ab2ba2ba", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637757497, "uuid": "48e1fade-93ed-43c5-b794-1657a78e62ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757497, "uuid": "9105a917-0cf4-4959-9181-e26414b16244", "value": "DOKUMEN_BPN_PHER001_021458989062000_INCONIS NUSA JAYA_125716432184000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c05d6e8-4d13-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637750501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750501, "uuid": "9e16ab82-56c5-4800-a9c9-c1b647483b4d", "comment": "Malware payload (ArkeiStealer)", "value": "305b15f989b2c78f0c9dd87be44fe742", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750501, "uuid": "c63c5ec7-eb55-4f9e-a067-b9a5b3871196", "comment": "Malware payload (ArkeiStealer)", "value": "21ae252c52490380ed11305693ab770d29bbae5770d71e6107c8fb5c153c6393", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750501, "uuid": "c2a927ab-5109-4494-9238-089bd4e882bf", "comment": "Malware payload (ArkeiStealer)", "value": "4583b9e5d1535420150b292be2b870f3561769b4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750501, "uuid": "22aaa522-113f-4f5f-a56b-98105a9c7aa9", "comment": "Malware payload (ArkeiStealer)", "value": "9c7a03d0f01d2d273ac997b641c99d252a69ec01ef6a586e98e561fadc2d6d497c17f6aaf7357889aba486fe1a6aa350", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750501, "uuid": "aa43e39e-9951-4293-8b01-e29ce561f9f8", "value": "T1EE14DF213AE1F872D4A3463016F0C7A17A7AB8736771804B3FA8167E5E707D15AB9393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750501, "uuid": "7870fc39-6e57-42ac-b61a-bf7783664c93", "value": "78c8430db0cbfbd938307d41d500bf50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750501, "uuid": "b2b51649-f7fc-49f2-9fab-b0478e4beb2c", "value": "3072:yHH3Mp8xkBHexwqnwrTkQ1ogv5oTaDRyJ/dFkz+2:IH3Mp8xkpxZ5oTeYlWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750501, "uuid": "c246739b-595a-4ed8-ba50-f246f3a7d2d6", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750501, "uuid": "e454a058-4652-4c65-bafd-c0eb548a1ecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750501, "uuid": "e340e0e2-4b54-448d-b1c0-11b86e97842b", "value": "SecuriteInfo.com.Variant.Fragtor.43959.22177.30818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e83972-4d69-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637787729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787729, "uuid": "7c869ef6-0ce0-4849-a003-46e0f0ede679", "comment": "Malware payload (Mirai)", "value": "59ee272a0d11aa0a91d60384b29ad185", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787729, "uuid": "26d49a70-7a39-4766-9839-506d098e4085", "comment": "Malware payload (Mirai)", "value": "2285b5bfd1370866e06aa98bdbca8ee2c46d6d9bdfcf01cdb97f095c5a46af28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787729, "uuid": "0faae19b-ceed-4777-a344-18cd6896c904", "comment": "Malware payload (Mirai)", "value": "21913b59e5541a90f1462965dce99d3a04f66ca3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787729, "uuid": "562dc265-8746-4a1a-89c8-74575deb2f9c", "comment": "Malware payload (Mirai)", "value": "7eae2cee1c5c4967c1bd16c6c14ae7ddcebf3e838de93b18ef0c7c696e771da662fd4d197cd27a50ef1e2c8515cf7de7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787729, "uuid": "625927ea-a890-4f47-afd0-54bf01d921b0", "value": "T1606328817CD19A16C6D423BBFA6E01CE332563A8E2DF32179D116F1177CA82F0DA7652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787729, "uuid": "7099ee3b-8dec-41a4-a5d0-7b5e4c4fb286", "value": "1536:Gw3/wPS/ZRQcQROv9BIRRczD7kaAoh+1jy/J1eJ9z:Gw37wSv44Qa5huZJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637787729, "uuid": "c7136457-1fc4-4347-b906-5a2478002614", "value": 71032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637787729, "uuid": "c86acb2f-6f75-4ac8-a246-c77aa8951663", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787729, "uuid": "bfa16929-20d7-4602-afec-4ecb4c9ca1de", "value": "59ee272a0d11aa0a91d60384b29ad185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be734e76-4d6b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637788569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788569, "uuid": "db36f6fc-be6b-4278-aa76-4c367e09f349", "comment": "Malware payload (RedLineStealer)", "value": "3061d94f78c4863d55f07dcc83e71b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788569, "uuid": "7e1c87eb-4ea8-4ed2-96a3-ceb5be405c25", "comment": "Malware payload (RedLineStealer)", "value": "23062ba932165210ebb3ffcd15474e79f19e6ad74869ff43923a0795b5072ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788569, "uuid": "5aa0036b-55d2-4f64-a5ab-575c42e4cabb", "comment": "Malware payload (RedLineStealer)", "value": "55493f963965be9cfbef19a09f56fbc5b979d821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788569, "uuid": "8b49cded-0612-427b-bef3-e6aa735cc91a", "comment": "Malware payload (RedLineStealer)", "value": "57ce0df447e67f56ec44dcce95a820c5dfa7c44d448088ef9cc98af77050ea5cfd6de23aa4e251b056d01fb2434aad33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788569, "uuid": "426fbea0-b2f3-49e7-968e-07fcb4b33856", "value": "T12E463313AF516071DA734C328C2A69481B397E601B98972F93D08B6DDE72DD0E631FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788569, "uuid": "1da9951b-8b86-4091-af9e-84c8e00a87b5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788569, "uuid": "a54d0098-d415-40be-a301-9328987f7df3", "value": "98304:PbiDp9rTdiYuZWZ/xK7yLobM3Lmzb5h2JeWYu5Dbh1ujv5WFf8RYaRMRl0XYmGQg:PKTdOZw/xtp3SzbX2Jhbh4jv5WmUKXv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637788569, "uuid": "282bbfc1-0610-4079-bbf7-a52056a2ddf1", "value": 5573165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637788569, "uuid": "0e687813-7ede-413f-8a0e-eb5b9bc3db06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788569, "uuid": "59877bdf-cbc8-49b8-b117-b7df3477fe2d", "value": "23062BA932165210EBB3FFCD15474E79F19E6AD74869F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31f1170-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637779181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779181, "uuid": "6ea26eb7-3033-4c19-bcea-2fa3bd0c5992", "comment": "Malware payload (Formbook)", "value": "647a6ff7a291048f4f0f8c4e206d1238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779181, "uuid": "2ccdd94b-9c51-46d5-9acd-c2f7511ffe4d", "comment": "Malware payload (Formbook)", "value": "232f876999f6681e26051a522b6f2a73668c407b499f4bd5a0b64236dce25a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779181, "uuid": "503ed2ec-208d-43f6-94d6-f5ca5800e1c8", "comment": "Malware payload (Formbook)", "value": "18a99d9966c8fd76d0fe73df7708d77e960f529c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779181, "uuid": "960cb422-e705-4a40-8b83-e184b31f4457", "comment": "Malware payload (Formbook)", "value": "324bb25da0b70a750642be961598d36dd07213cdaa105333f45e9bd45f7d4866ce40ac58d84e72137b84a7af625d3cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779181, "uuid": "59944ffc-48c7-4a7c-8065-2bd421b17696", "value": "T10654224EBCD4683FEA9605700CB65379E37A85C871A724261B70FA9B2B700934C6D677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779181, "uuid": "018a748e-7126-423f-9c74-22c272a66239", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779181, "uuid": "ebd60803-984e-4129-b284-8329fe28f296", "value": "6144:rGiF/axrIf9+eeQpdTtFWna3Awc5wywRQFXywRyqJCUpj/C63cT:B/axr6+exJ+88ySy3UpDC63i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779181, "uuid": "d3f9177c-53f5-425e-ab7e-882439f4bcdb", "value": 301978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779181, "uuid": "d293f2c1-3731-4309-a5c1-5db13fec516c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779181, "uuid": "8fe931ab-75db-4239-9a3c-b7a058ce75aa", "value": "647a6ff7a291048f4f0f8c4e206d1238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc9043e-4cf8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637738964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738964, "uuid": "3c716b05-cb09-4c14-85df-fdab8ed63aa1", "comment": "Malware payload (Gafgyt)", "value": "72c2681d27caf60ba558c08cff7e4db0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738964, "uuid": "e542766a-eeb5-4fe3-8dff-a8f1449dd24d", "comment": "Malware payload (Gafgyt)", "value": "2338f5fb7bf9586eb40a0f4723879942a4e0f9c35b14445e46f48773b3b85c50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738964, "uuid": "e4868378-cddf-495c-93b0-d5c1f6a23eb7", "comment": "Malware payload (Gafgyt)", "value": "03cf53dae0fc0550920bbcdb4ae0e06201e73b00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738964, "uuid": "96babac0-5893-48f6-9212-2d0cc5a9aaf1", "comment": "Malware payload (Gafgyt)", "value": "3ae5f37011860128501e578497cbe38f4279188d76baab85a807d3ba05b8f4c9e4860d4c26747f9eeadf722a6528bb61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738964, "uuid": "51f665c2-1263-475c-83a0-e6f2a42ab209", "value": "T115833B86F742CEB3C48316B1029B6B255A31F9AE0A5E5E45F31C6DF4AF121893227F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738964, "uuid": "9eb6dae3-9b91-4f65-a261-66ba28be54f9", "value": "1536:6ChtjNqiEAWBcwbYyVmcr22uD7nVMJV5hjysrmb4ZIuJbEIy0faCjtafbPk:ZtjN6+wbYyVxJuDuP5hj3rpbvy0faC55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637738964, "uuid": "771fb194-3f18-4f27-80b8-29799b8d056f", "value": 82003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637738964, "uuid": "ed711e8d-7b45-4db3-8edd-cdc64439e75e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738964, "uuid": "16a03466-d6de-4d72-ae9e-ed7362ecfbcb", "value": "72c2681d27caf60ba558c08cff7e4db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affe3b35-4d4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637775660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775660, "uuid": "cdb46139-3cdf-4d7d-9dbd-deec35451890", "comment": "Malware payload (Formbook)", "value": "2423f10dfa60228ac897f5298cbecc19", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775660, "uuid": "4c1bc1f7-e007-4846-84e2-5b8e043a7c8b", "comment": "Malware payload (Formbook)", "value": "23a1bb6bea87c88b0631751f4d1fd505dfd935c277a540688412c8f7390c9076", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775660, "uuid": "e5f0cd29-84b4-4cf5-921b-22f047adddce", "comment": "Malware payload (Formbook)", "value": "ff7a8e1b9593557c82b2bbd96f14adbb705d2e9d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775660, "uuid": "36822fea-ab1f-46fb-a66c-e6a480b439d8", "comment": "Malware payload (Formbook)", "value": "06a48bfe389ae71f02928c189070dee0981848bb8e51828bc2d059c2d5cddfc9f9ad6947e8940489bac130ac9806b16f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775660, "uuid": "3cbb9f9c-a9dc-4840-98a7-ed1157e04e18", "value": "T19D92A1ACC59302A88F866BB8671B6F49058CBA6CFB99A5333678533107E1C3E501787C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775660, "uuid": "816de843-6dc9-4a0c-bb2b-15b481794e27", "value": "384:bybfWqrc1hBC/agXIlJEZirt0yoAHG2jvewuvJ6R5:GbfWjHynXiJ3SH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775660, "uuid": "6771bbf4-d009-4c6d-b851-037c8b33eb93", "value": 19534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775660, "uuid": "21babba1-31b3-45e8-89cb-e8fbd747340f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775660, "uuid": "4fc07d88-5979-420a-865e-a1b16386fedb", "value": "874578.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755a59b1-4cf9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637739484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739484, "uuid": "8617ad97-d774-487c-947a-54c812b066dd", "comment": "Malware payload (Dridex)", "value": "52a9f4ae1a9a426c20c9cbdd3beb2f8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739484, "uuid": "908f4ec1-422f-454f-89c5-2d5ee2642c1c", "comment": "Malware payload (Dridex)", "value": "2546359770f46f8cc28b614ecf18387bb5c07c635e4ddd9211740a82eb01ce99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739484, "uuid": "64116e0f-855b-4c31-9dc4-610a24657469", "comment": "Malware payload (Dridex)", "value": "7d8f42151b34d908107c92ab993216fbb91c2645", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739484, "uuid": "d16f8f9e-4b0f-4235-8177-3fcbb5a62dbb", "comment": "Malware payload (Dridex)", "value": "a3a41deb4816e0e49c8d5f46e54ae97a63fad3c41e8a6f567a6e425fe5b980856aa380563f76e11ef0edf381824777ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739484, "uuid": "0f75592a-a275-417c-80b0-aa45425114d7", "value": "T1D373F21C55A735B0D690FF3D8F0E44F76A692B165E103A8F0889EE8C8A35597AF4F10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739484, "uuid": "0eac645c-d591-4122-989b-89e6bf757e3f", "value": "1536:UWIPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hZ1G1SDgdT:V4qmc3/q0dfaguKyZ1oSDgdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637739484, "uuid": "fc5a82c2-d5a6-4af2-810f-ad6efda89527", "value": 77773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637739484, "uuid": "d7d65aea-97fb-4e27-9af9-bbc9bbcd5df3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739484, "uuid": "53c2ebdd-5acf-4ea4-9309-0b303f3833f1", "value": "Booking-6880.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4661ea-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637779089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779089, "uuid": "e3bbec44-b7e9-4c8f-9ba6-a027b455ea02", "comment": "Malware payload (Smoke Loader)", "value": "3d5a818c1f9e829a49db4452fc0477cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779089, "uuid": "72959a44-e52d-41a7-b2a8-99a69b1cc7a9", "comment": "Malware payload (Smoke Loader)", "value": "25a53d690b693963b47fa3b860f76f1df94704141c830ea06693c10ac502786a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779089, "uuid": "9c9b340a-54a1-41a7-8ee4-76b061fe56b7", "comment": "Malware payload (Smoke Loader)", "value": "8f3b07c35f409218a703e248223323f03bff07d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779089, "uuid": "6e27d71b-b53a-4de8-b943-82d59c9fbc88", "comment": "Malware payload (Smoke Loader)", "value": "0fdadc10dcd7af91cc35f34b3ea3b0c486b3dc83f09dd4a85e3bbd2b5faca204b68c9f1847ac742dd3e795c585716c7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779089, "uuid": "19bd3a98-a805-4e5f-8a51-5e24b5587938", "value": "T163E3BF11F2E2C035D1B7163028B49AA11D7ABD726A75428F77A8363F1F732D14AA437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779089, "uuid": "fd1c284d-7a53-4395-8a69-7fef25760368", "value": "7fa5c9c2dffd615fa15cdafc116d6f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779089, "uuid": "21f2d2bb-0a81-4286-94cc-cab3119c5f23", "value": "3072:4xneBvEKHDDtZAdhyzDs5RszPhQ1lKki52:ntE4DtZeksvtrDio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779089, "uuid": "00da2c36-de70-4322-a0cc-3627585d5e75", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779089, "uuid": "f915709f-307a-4001-9ad3-6aa3073a98ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779089, "uuid": "bd1b4408-a6fb-4022-957d-d94bd19c02ec", "value": "3d5a818c1f9e829a49db4452fc0477cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167084a2-4cf9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637739324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739324, "uuid": "9eca4700-0387-4327-ab45-8f37c2d00956", "comment": "Malware payload (Formbook)", "value": "2047db38e2d0017545a2842b5266b9ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739324, "uuid": "485b88b7-9c1b-456d-96af-6e2dcb763fe2", "comment": "Malware payload (Formbook)", "value": "25e4adba5d0ef98cb4f2a30b964254c5189d687d8af747533fe380907f36173b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739324, "uuid": "98fc1cf9-5bf5-496c-907f-e229264d2651", "comment": "Malware payload (Formbook)", "value": "298b391c34e934bda7808a54e601b6c64dfba05c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739324, "uuid": "54d6fe46-c4c9-40cb-b4b6-20a32c893b84", "comment": "Malware payload (Formbook)", "value": "751503b46dcbdb4f816d5412fc30d894abb0d5523ed2f4d36a63dfe1ee7c2c9383a33e3c24a49855f223bd1ac50f5a64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739324, "uuid": "99e7777d-0716-4769-8992-698c2b3ed1fe", "value": "T1F4B4CE31D7149BD2C477ABB01829241E6B357B5BB0BDDAB45CBC72481CB3AC68223E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739324, "uuid": "27ce951e-76f6-4958-9b61-586b3a93d5f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739324, "uuid": "a77d5d2e-84de-48bf-80ba-e695a0cc720c", "value": "12288:ddTSzrUWkV6K/cpT5PVA74KXt6jfAGbzPWlLv:vyi6kYT59A74KXA7AGbzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637739324, "uuid": "0073407e-45b4-467e-b9a2-b92334dc9f14", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637739324, "uuid": "5c03d3c3-9eb8-4d18-9fb5-210023bcb16b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739324, "uuid": "076c1d32-e2d3-402d-93f1-7c9ece9a3ac5", "value": "2047db38e2d0017545a2842b5266b9ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e90a87-4cdf-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637728296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637728296, "uuid": "ebae819c-f4e1-48dc-8c66-9774808933fa", "comment": "Malware payload (Loki)", "value": "1a01c0cca009c9bd8bb546828da7393b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637728296, "uuid": "3d464c7f-2abe-474c-afbe-6bdb9e49d593", "comment": "Malware payload (Loki)", "value": "26814f3709061980bf6dd4fd051e2c48fdc073ef33af56d4fcf7ae2bdb8f5646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637728296, "uuid": "cd589504-acc9-4134-8546-3d311b4ebff3", "comment": "Malware payload (Loki)", "value": "a3d6503156890b7ed93bceadc62087803ce24a9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637728296, "uuid": "514bd808-df43-4792-931b-3ad31f7e24fe", "comment": "Malware payload (Loki)", "value": "9b8f9066aeacc9f487d7bb2da68a1ce13eff49b7a03b13271ff14fba237c070f810c499b5140f957b0385aabd109577f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637728296, "uuid": "fe2c48df-1e5b-4478-a0a7-e15b30fa5745", "value": "T18054F16032E57397CCB64BFA0C61208813B371457E25D75DAC8962DF2D26F268B12BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637728296, "uuid": "384e0b89-7822-44ed-9dd0-095bf3046629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637728296, "uuid": "9a5eb09d-bca2-4015-b68d-938be848fe7b", "value": "6144:GQTeYvEAbJZwHx/nT4p0ONxT+ur0D2MnGxMiYUEo3w:GIBeESONxC92cGiNGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637728296, "uuid": "49728b2a-dc75-4a13-a09d-30573c6bd011", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637728296, "uuid": "80df62d9-1759-4a70-aa76-ea19200c18eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637728296, "uuid": "3c74709c-0a45-4d25-8d81-4b3596684eba", "value": "Order EnquiryCRM0754000001965-pdf(109KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117c0feb-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637764656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764656, "uuid": "5561707c-029d-4c58-89de-582a8e80337a", "comment": "Malware payload (Formbook)", "value": "e652575c43d712e5d3da0e2970250693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764656, "uuid": "81c29a5b-b64f-4839-8d93-b1d1323bb2c3", "comment": "Malware payload (Formbook)", "value": "26a193d73c8ff03c76bab877f9a6a4d16078a09bf5abb85ab104d2d7d0685315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764656, "uuid": "1fd3c928-b2ea-4185-905a-6433b04feba9", "comment": "Malware payload (Formbook)", "value": "c519071505377de0cfda6d43c0f87e2e9eb9ac16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764656, "uuid": "6a3f3aff-1f50-4489-845a-572f4a7c1953", "comment": "Malware payload (Formbook)", "value": "bdf218151cfa19360126653da5b540577937ed6cb3304212de5bb8b96fcce3ad5e3a7c5b55f0d3eafd0675f4246dd7d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764656, "uuid": "4fe750af-6198-4082-b179-3aabe95084b7", "value": "T19364224651C0846FC6A080351CF3C37AFBF7939581B19763C7A15FBF6EB2A818C56195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764656, "uuid": "67759fa8-bee4-42d2-8951-e1f0cb279804", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764656, "uuid": "7cde6b62-e790-427a-943c-243d8718cec5", "value": "6144:rGiVipX8SUxDj+eP1ZPlOjBSbICBDMLFhKTMNSlze4FQY:hipsS+X7TPgjBJC2L6TesXmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764656, "uuid": "ede268dc-d026-476a-a6e7-fe895409dd95", "value": 319689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764656, "uuid": "5c28af21-3d86-421b-b600-8e48b88073e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764656, "uuid": "52981209-0665-44f6-8296-76c7dc317cf6", "value": "binshed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a581b6b-4d10-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637749317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749317, "uuid": "715b9efb-25e4-4559-8026-bd42aef5592d", "comment": "Malware payload (Formbook)", "value": "badaad0d93f7a39a5d788d2b072e7328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749317, "uuid": "4fd41606-3d33-4115-b8ac-c2528de1cc2c", "comment": "Malware payload (Formbook)", "value": "26b24cfe3b0bb84b26fc83ce689b74728ac61f32391772dcc76eab04cc7042b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749317, "uuid": "78636c25-2d9b-44c4-9105-c72ac5adfed5", "comment": "Malware payload (Formbook)", "value": "3a35ca6c8f2f4005eb53b6ab1ce25b42db2c7dc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749317, "uuid": "99e5c133-f379-4278-9f9f-1ca1f99b1ac7", "comment": "Malware payload (Formbook)", "value": "ae12499f2ff1154da79cf9072725d19db12432804bd2b36507a9dbc9454602ed339331143e44abde7b3007a0dd44b195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749317, "uuid": "e78bdc9b-1bb9-4f68-9f3a-a3c904611da1", "value": "T15064230762C494FBE5110A3AC473F96DFA7A504D45A2C8F3AFB43EBF64203A347525A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749317, "uuid": "91caee70-acb6-4dbc-bedf-5179f387d434", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749317, "uuid": "f67038b6-b4af-425f-b246-809f328b0e9e", "value": "6144:rGifbG+tbR6Dq4jSxw/d4/GZQq7FINE/9gGUg8WjUbo/ZMC:rZbUq9dg7Z9gGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749317, "uuid": "a13dd248-b92b-4ba6-a68c-fe7f574a62f1", "value": 306637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749317, "uuid": "f0786238-d5c6-48da-b000-a7dfd9fa82cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749317, "uuid": "94d15e0f-fb77-490c-99bc-0f53295a54f9", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4182eb6-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774459, "uuid": "a9742a41-4462-4a9a-9eb6-9c4a73d908a4", "comment": "Malware payload (SnakeKeylogger)", "value": "02bd1f1114443e0ea85b057359bf556e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774459, "uuid": "1b2bb4a9-1222-4f60-a100-65a2a7c7a6ee", "comment": "Malware payload (SnakeKeylogger)", "value": "282661a569d8f3702e8cebcf6014c434e2aed91ba480383e3c05d5c5a2687177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774459, "uuid": "cc0569a9-47fa-4560-a471-e8f269c54001", "comment": "Malware payload (SnakeKeylogger)", "value": "fdb03ff19671bf80729bcd2a0036404f8447bed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774459, "uuid": "63627514-a0eb-4850-803e-2f95a33efce6", "comment": "Malware payload (SnakeKeylogger)", "value": "0a40a9932a6da8a5610ed281131a6b67f82118e5ef6e7fcae04edcca24830d204fa28d9d0ca53efc0f05b6b2732c934a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774459, "uuid": "adc34265-fe3a-4944-9b84-a3a61e0e53a3", "value": "T1C2A4022072E99723C8364F3A496060C16672E65A2D11EB8F7CC8174F2D9BF964F12F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774459, "uuid": "6de40b05-585e-48f9-9908-63b15a66b76d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774459, "uuid": "0d70f2a5-8160-451c-9a1b-912583e240d9", "value": "6144:FeEmu4KugT0+DaFxmuPJzJhGBuDIv8KRUvsz8ktyJmnn2zTl5Q4CbsCYCxK:FRmUugTRmFtvhuucv8KRUlktyJonZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774459, "uuid": "1d35f694-6b58-4a3b-9a75-5bcce78e859c", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774459, "uuid": "3b2c2b8d-ad73-4051-9284-94a872eeafc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774459, "uuid": "12021414-f8ab-4d7a-affd-b0351ec92097", "value": "Dekont 24112021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1360c4b8-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637749627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749627, "uuid": "01b3aa47-82ec-4f40-9f9b-aec2626043ed", "comment": "Malware payload (Formbook)", "value": "6c925989c90f3ad91f76f04816800bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749627, "uuid": "042a1645-46aa-4e6a-a532-6759e31d5c22", "comment": "Malware payload (Formbook)", "value": "285cf3ef067e949b6b0e413f43b5cfe89504f3e427c4387bd76765b98d059a15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749627, "uuid": "a72c1fac-6278-4e4a-b178-654056f71772", "comment": "Malware payload (Formbook)", "value": "66de14608e25bafcf7e5adb7ecc5d6a302a9d5c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749627, "uuid": "51b40c04-dc9a-4e67-ab21-220449df65db", "comment": "Malware payload (Formbook)", "value": "d3ebd3bfc964556241ba9d418809b8172d4f7bd15bab5f2d3c736d6884ad54c2cbfbe13a16ea69bae1b089aa2ced8ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749627, "uuid": "26a0b437-3d8b-4c6b-a56e-cef549fb17f5", "value": "T1E2642309E391D177E3D919B52BB25BFABB7AD5C840BC4E0727887EB53677100E9009A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749627, "uuid": "8eff709f-c73b-4326-9812-3e15f892363b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749627, "uuid": "92986eb5-96a1-4c1f-81ad-00eae81ef62f", "value": "6144:rGier5nQ+hcRnj1yvJMIKa35ImAcMeEafjKqrELjAWgnfO:3DovJM0emAcff+qrELjAWKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749627, "uuid": "ad5b3e3a-803e-4535-9ea3-dc459bbad728", "value": 316461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749627, "uuid": "fc09f834-6636-4842-90c7-a30e37fa9511", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749627, "uuid": "43e81455-a36e-4c47-b6ff-15ba92698f65", "value": "Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83376b9-4d33-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764533, "uuid": "767f4258-7cf3-454c-8eda-a5254e0fed55", "comment": "Malware payload (Dridex)", "value": "00fd3bcb0037cee8e3ebab152962cb19", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764533, "uuid": "8ca3da05-671f-4d9b-9874-945e4909d5e8", "comment": "Malware payload (Dridex)", "value": "28b92e3c6034fa90e3e42bb2b400d57af01d62819349a29ea176c531059489c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764533, "uuid": "885b596a-4802-4778-a281-cac23e796271", "comment": "Malware payload (Dridex)", "value": "918ca66efeb426e3eb7763861776f96466406afd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764533, "uuid": "2ab6f2be-d1cb-4d42-b2d7-123dd6a128a7", "comment": "Malware payload (Dridex)", "value": "6c201867463828534ad632e7c6f30ebc2d4e56225e3baa7412e7d7cb8f6dfc52dfc49057d4b1b162ce4c86373b9d8976", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764533, "uuid": "c1dff87e-d366-4244-ac98-267a46f912cf", "value": "T16983025D5ADAB0C4C32AFC7D024D18A27D6988125CC193FF09B9B25C05F5B83AB8E26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764533, "uuid": "02c8eb49-9396-4088-b714-10476bcd033e", "value": "1536:UWWPZZKz/1eCzbqzLkh/OPvTFVThqSTRNgiG3d/JC30rPrcU/Qgd8y:VWEz/9qGWPvZVThqo7GtB45U4gd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764533, "uuid": "c07a9cc3-fc82-4d1f-9814-43fc59e73cd5", "value": 80985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764533, "uuid": "d7ed4b9d-47ac-438d-b5cd-7ec7ef24856b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764533, "uuid": "042666ca-363b-496d-a13e-e069c78df9c3", "value": "request-038477145.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb8cd96-4d6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637788002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788002, "uuid": "223e801e-43cb-46f3-ad28-86eb2de35fd9", "comment": "Malware payload (Mirai)", "value": "6eb8f94b8a1bd696612118de17a0f889", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788002, "uuid": "1da84df0-e41f-4c76-b01d-ad4d47110d30", "comment": "Malware payload (Mirai)", "value": "2917ea3fb37a2cc32bcdd0a585a4ca50323856e0dedb8d2f11d49025a00d8293", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788002, "uuid": "67071e12-c787-4dd2-8fc5-2ac5f7ce5af5", "comment": "Malware payload (Mirai)", "value": "18a745a620d7a4b178768846b9b7007618267c0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788002, "uuid": "95a48b6f-4174-4a68-84b0-bf7876d1f8d4", "comment": "Malware payload (Mirai)", "value": "b115035bd6a3dc242ae5aa38f3f5a673299dbf88bf96027ab357cd2a5e9d7a660bd95010cff4ea1f16dfc8349a70fcd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788002, "uuid": "d52914c4-f810-4882-a527-3dff8cab32e5", "value": "T1A193B54E3E358F7CFBAD823447B78A159648339A3BE1C584D15CEA012E7024E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788002, "uuid": "3771ec06-34da-4781-8fe4-8effb99f59c2", "value": "1536:pJ8VzxOGkT4XcrvmDTp7Dk7D2q7DWi0t/MyDd/nNeOfH4ud7aJb6NqeSDe:pJWiT4XrDTbtkyDd/NrH4ud7aJb6Nqbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637788002, "uuid": "b1d6aae4-7cf7-444b-a4fd-edc9e2b5893c", "value": 88864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637788002, "uuid": "80c1bd00-0b5b-4dc9-9719-cd7129b49dbb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788002, "uuid": "c1db0aa5-d3e5-4e5b-989b-7fc01db5490d", "value": "6eb8f94b8a1bd696612118de17a0f889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ff6991-4d3d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637768771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768771, "uuid": "e30fd632-5bf1-4063-b5ff-614da40a76e6", "comment": "Malware payload (Heodo)", "value": "07b12400c7e5de7277990b7f915fab86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768771, "uuid": "255f0598-dac7-45a5-bf10-1887a421b6fb", "comment": "Malware payload (Heodo)", "value": "29824af13608047e8886fdee9d7f6d52ab31d50c397a3feddf48ae0fe402b645", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768771, "uuid": "102507f9-04cb-424e-b47c-4621696d6c37", "comment": "Malware payload (Heodo)", "value": "dde01b5050aaf3c1cb1a99d04e58c994e40f1ccd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768771, "uuid": "e09a5e64-ed2b-4761-9293-382d91b5fdb9", "comment": "Malware payload (Heodo)", "value": "e46e124523b3e92dc078a86b4d47bf241578f541d440784e4f7fbc2340bf08916f63c09ab1a914b8059810465e9eccc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768771, "uuid": "b8400da9-2dd3-483a-80b8-95f62acb9d4c", "value": "T134A4BF20F5C3C072D1BE09307978DB9609AD7D304FE5CAEB67D85A2E4E341C15A39E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768771, "uuid": "5823eeb2-4752-4b35-8335-d978a23e552c", "value": "f81a3c8b673ca7b3a7f6c06eaa20660c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768771, "uuid": "283cd165-16c1-41e1-9a2c-631295d4f1ed", "value": "6144:m3M5xEQPjPLlMcp8gvSaX5EAoiAO0X1Ab8JOKXDebPG0+Z0C4OGUBbiA1:m3M5Bj5Mcp8QlwiaMYe6DZrzGyWA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768771, "uuid": "ce12925c-b43e-47cc-921a-9444e30cc4db", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768771, "uuid": "c41d4e06-2fe5-4aac-8d8b-95cc7653b81c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768771, "uuid": "00096181-5593-46c1-8a12-d3ac6ed9b338", "value": "07b12400c7e5de7277990b7f915fab86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36697d8c-4d26-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637758705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758705, "uuid": "cdad463f-6a75-4dd5-b9e9-dace90942184", "comment": "Malware payload (Dridex)", "value": "8b1bbb00c988c26066138117caec5586", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758705, "uuid": "50f25fd0-49b4-4586-9f74-ee2c175111ce", "comment": "Malware payload (Dridex)", "value": "2a06a99cdf221980cedbfd9910ad8a26ab797f3a6aa597816dbc5341b658efb6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758705, "uuid": "02f88475-2dc8-493e-9a4e-701284d76fc4", "comment": "Malware payload (Dridex)", "value": "a72c02ec4a281054005583da2d2596cb9be6d188", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758705, "uuid": "353f738a-ac27-434a-9655-489978540263", "comment": "Malware payload (Dridex)", "value": "47867f64ffe8d6ca6bc5d80a35e5c01a4221ad90f15c45e95f0a73b4c26705f3fe78e2a6f09179033a88664fb91b2e22", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758705, "uuid": "04d1ea2b-df5d-4cf6-ac15-c223af2732ff", "value": "T1F383025F667AB5E4C950DC3E424F18B6FD51CA251AC4EA9B18F4F31809F1383AB4906F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758705, "uuid": "769c71f6-5f0f-488c-b72a-49ad8973fbab", "value": "1536:UWibPZZKz/1eCzbqzLkh/OPvTFVJRcRjVlcoF+nwj6gdQM/G:Vi1Ez/9qGWPvZVJyRRlc5w+gdQCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758705, "uuid": "855b571f-76e5-43af-a4a9-cd5093f9a08d", "value": 81965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758705, "uuid": "b411a74e-0eb3-4985-a9d5-a4856046211a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758705, "uuid": "d9c8e7d5-982a-4801-bfbc-3f47fac31b65", "value": "9049521.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8034badc-4cc0-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637715021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637715021, "uuid": "71013bb9-4861-47e6-9dd0-8f88be3cfea0", "comment": "Malware payload (AsyncRAT)", "value": "eb7529f99643459fde37db17a63ac95f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637715021, "uuid": "b396aa47-18f9-4fba-96d4-96873c67b700", "comment": "Malware payload (AsyncRAT)", "value": "2a5fbb2e4cb76e0222b6aa4db1d2822614d2a130e8df41bea4ce37e0de24f251", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637715021, "uuid": "fc3030b2-ff05-4103-95d2-831d72eb255f", "comment": "Malware payload (AsyncRAT)", "value": "b5c98397c71d9a2f8ce719dd94ee5a8cbe145fe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637715021, "uuid": "53768432-2a88-4904-ab04-1005f61efd91", "comment": "Malware payload (AsyncRAT)", "value": "3253f22ee2a59e688f3a27256cb31e5fa2e30221627aa6ae03bc5d578c5ec244c1da054630aa1c481d87e285dfa5b1e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637715021, "uuid": "85338175-815c-4a0b-b59c-44d10195f96d", "value": "T19A944B17B714E06AE1964CB14C72D6FE28197C764C404D1BB0C8BF4E5AB26C775BA32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637715021, "uuid": "0a1b86ad-e97e-4516-b850-df18cc8f3cb1", "value": "5d9b313bc18ecc091268bd0fddc97329", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637715021, "uuid": "750927b2-40eb-4d33-8dd8-1bea5cee6416", "value": "6144:0WpBAsxAAFz1G2DE4IIKpw8CVXNoKMKbj3/7zCeK+swUpJrIYLQx:0q19DY5pw+Ilx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637715021, "uuid": "730dc20a-a10c-45d7-a485-b76fb82a2dcd", "value": 436165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637715021, "uuid": "67248dc6-eea6-4851-94af-c80ca43453d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637715021, "uuid": "9f27991a-9c2e-4c82-be9e-7b5022618829", "value": "eb7529f99643459fde37db17a63ac95f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b6ea46-4d3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637768187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768187, "uuid": "0738383c-1ab1-4efa-a229-b185f7f7581c", "comment": "Malware payload (Heodo)", "value": "8b540033f4ffd79e5109e41a06f3e876", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768187, "uuid": "fa733c9b-c916-49eb-9f95-efb5bbaca229", "comment": "Malware payload (Heodo)", "value": "2b3700c2a383b322dadfebfea00d9bc85b05a37793dc366954dd8c882f3006e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768187, "uuid": "35ef0eaf-13b1-4c4e-86f4-635d27fc8441", "comment": "Malware payload (Heodo)", "value": "86a8b94f1a3102ad3741fabccfe5ea5d9a3bf624", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768187, "uuid": "fe6f189b-ea28-45bf-8a33-9fee17732b11", "comment": "Malware payload (Heodo)", "value": "8f13e15cc0fd83600ddb3da2f82abd896be8825ff212998e780af66938f4eb63d8825d806a099ff4cf6ef150326d4a86", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768187, "uuid": "b9abee16-6a5a-4c63-85f0-e2aa07924893", "value": "T1B1949D2325EDBDE2D5B9173037B7C7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768187, "uuid": "6797daaf-3627-4e63-8d3d-d9101c16ea72", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768187, "uuid": "3cd301a2-d5fa-4278-b004-e118847a11fe", "value": "6144:1ACzUEcRRKxe0DUAldEzpLGE0sepO8+wM:1lxemHQtGE0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768187, "uuid": "d043b58e-2488-4d55-ae34-6faf54daf397", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768187, "uuid": "fd57e102-df22-4b5b-b0ae-a004c28e05bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768187, "uuid": "07a3f745-c020-4a64-be43-4e1cff2b2239", "value": "2b3700c2a383b322dadfebfea00d9bc85b05a37793dc366954dd8c882f3006e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92a0386-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637779165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779165, "uuid": "59e376fd-945b-4c0a-b211-62c52daa17ac", "comment": "Malware payload (Formbook)", "value": "a0e6014f72be2a52b6c40021348b429d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779165, "uuid": "7328ef7b-a77a-4f83-a0a7-5ae4283d68a9", "comment": "Malware payload (Formbook)", "value": "2b61cfb00cc8a45fdae91c176c8e68be4ac7cefbe0fab5781e5fa44d2ec4ca9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779165, "uuid": "e0e3a9fa-c847-40bf-94ae-ae6fef21b128", "comment": "Malware payload (Formbook)", "value": "504fbe18ffb86b1eb5c042cb035a406db3ed4c30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779165, "uuid": "9225dce6-51a5-4e87-b519-04660c10569a", "comment": "Malware payload (Formbook)", "value": "b417ef4970d3f4653f5293f841c67f0c4bfa5cc1aaae3cb8ffd983a50a7d4ce8a39a36f39cd2a34e53ce5afa8c35ee46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779165, "uuid": "9f6c9970-cbc1-43a2-a304-a321bd5903ea", "value": "T1A994012032D0B367CC764BF50D2422C517B321423D25E76DAEC921DE6E72F5A8762BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779165, "uuid": "62f6095d-7301-420c-ab09-1501efc32d74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779165, "uuid": "4a4f71ff-037d-4cf6-9499-0325abd03cd5", "value": "6144:99gfj75ya6lCCIdwtL7kfUAsQrdhWsWocp1yK9ljgSpkQLxr35d7Rrh5:9E4aqAKe3WsWFdBpbLnJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779165, "uuid": "48eb487a-0c00-40eb-8c97-cf6f3c488dfd", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779165, "uuid": "570ee003-c9e3-4d4e-be95-8bdc4fbf48d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779165, "uuid": "6ae55200-872a-4be7-87c5-0aefe879fbc9", "value": "a0e6014f72be2a52b6c40021348b429d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e66def9-4d13-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637750666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750666, "uuid": "6369abe0-88a4-462a-a424-54a73820ca4c", "comment": "Malware payload (Formbook)", "value": "eaf0f5582413df46f615ae15dc338ba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750666, "uuid": "45a2e8ce-f5f7-4a4e-a594-120dc0778953", "comment": "Malware payload (Formbook)", "value": "2c0a4dc1c283cf4e916bce8be22984245a993ac8028e3466ea107d28083d5e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750666, "uuid": "42e501a3-c74a-45cd-8e47-1b6480960d69", "comment": "Malware payload (Formbook)", "value": "a9106474b6eba18ac607885c61856d443d3dfb52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750666, "uuid": "a010d51b-a489-49f1-b71a-7e0cb92687b1", "comment": "Malware payload (Formbook)", "value": "974aa2f83f9d0ffa8f46f797b6e9803f0f063cf4ed29b88a8d54da9081f51b965f5643934df090226131b47a5b54dcdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750666, "uuid": "c4436d9a-60ef-4f90-8795-174c9bf09745", "value": "T16CD40150365197A7C9604F321962E1B027327D521911E78E2EC83F6FBE7B7598B02BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750666, "uuid": "a06e45d7-a133-4bd2-8d75-9e48fb1eb8ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750666, "uuid": "2d0eaa22-6f7f-4583-99f7-f5c52af5ea9b", "value": "12288:Xw18iOrhCay9x1Jim1IJ7XeZDm64SCkFBAk/iOUDnKUFpEp:XUOtCvpDOJrKmnkFBAo8Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750666, "uuid": "f25c9108-5107-4a3e-ac43-ccb90977d776", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750666, "uuid": "517739c2-20b2-4909-9916-5e018c219bab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750666, "uuid": "8fe27b78-292a-4290-acca-d21a78011744", "value": "guNovtYh0QYIrA3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb67cc7e-4d33-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764619, "uuid": "41d493fc-32ec-43c8-a232-9bbba7fd4637", "comment": "Malware payload (Dridex)", "value": "f7785a8150bf9fe51cb48c6a3bcf3703", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764619, "uuid": "5a9f438d-adec-41d0-b300-c5b37667546b", "comment": "Malware payload (Dridex)", "value": "2ccf743250286332ea78b3ece18b59bd15744b0356234dead79eac52091af298", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764619, "uuid": "c1d49330-df76-45f7-869a-ac3922422d33", "comment": "Malware payload (Dridex)", "value": "64871f6d22b913ac6f19dbd0479dd115a7e6fd18", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764619, "uuid": "db5df03d-11c4-445a-bc51-02a704b1f794", "comment": "Malware payload (Dridex)", "value": "5cb4fb32263430127d01141c6d99b8834a23675d5a183eb8383db46881c14b3de152502d7c9030a91d84f62948fc464c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764619, "uuid": "74389ea5-887e-488b-9e00-ba26a120f6a1", "value": "T1816302AE9A59B4E2C354FC7E024D18BABD159A2158C492BF45B8E70C13F5387FB0C49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764619, "uuid": "76442391-7774-426e-b876-911bc5b8fed3", "value": "1536:UWjPZZKz/1eCzbqzLkh/OPvTFVtTa6EUhP6nVLgd0T:VtEz/9qGWPvZVU6EUZktgda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764619, "uuid": "2d679d09-af14-4fb7-8ca7-4b3c7caa01eb", "value": 72889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764619, "uuid": "c3d087b7-9192-4b95-a56c-0bed11341ddd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764619, "uuid": "0d992393-677e-4b11-b3dd-636828d08b39", "value": "promo details-747242.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470708da-4d2e-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1637762169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762169, "uuid": "b2e02280-63e5-45b8-a6bc-8ffb228036b4", "comment": "Malware payload (NetWire)", "value": "8929285ddc956132935358012d5a21e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762169, "uuid": "49aff2fa-6c9e-459c-8abb-f41aa9ea81b0", "comment": "Malware payload (NetWire)", "value": "2d81d74a3b4c930ffbe472ad154acc01bc2312ded21aa30fe77bfcb20ee331f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762169, "uuid": "2f91bc68-0d3d-4b36-8429-7c5507fefa0a", "comment": "Malware payload (NetWire)", "value": "84cc378d35b240c38ed0c7628e99064fa50dee9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762169, "uuid": "be19b1b4-2bd8-438f-8981-40858d94b263", "comment": "Malware payload (NetWire)", "value": "be3a8d73f5f547a0fb1885ea21d55cc3ea609036f140ca8bfa85cc9b856a0b2b9ca2a416f02eedaad2f7bbb1662f279a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762169, "uuid": "db4418ed-2cf4-4c59-a6bf-df0cce3613a4", "value": "T18AC4019433986787CC7A5BF11C3190C523B371662410DB1EACCA62DE2D36F129B5ABB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762169, "uuid": "210c2788-cc91-4bea-8940-00943e875e59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762169, "uuid": "1ccd1a23-4729-4747-8f54-5300eed3cc91", "value": "12288:ptD00SHPuy/NycYGThe9LvfOk3DkdLQ9TTTSxofD4wmH:pC0SHp7cbf5kdLQ9TvSxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762169, "uuid": "b88f294f-ee01-48a2-a505-86f5cba8b239", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762169, "uuid": "05321248-4662-40b1-914d-2eb843e7bf11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762169, "uuid": "fe51ff4a-1c8d-4db1-bd7f-564b257f8080", "value": "DHL Tracking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef7b2e0-4cfa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637739876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739876, "uuid": "21eecbcd-7b32-4b07-b104-a23e7b7928d6", "comment": "Malware payload", "value": "2da3e71c2ffced06b9d662ccf12411c5", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739876, "uuid": "a3babcfe-d4a4-439d-a584-b602ef379dc0", "comment": "Malware payload", "value": "2d8471cf29e205c9df9d1235e3acfff3d99810bdc262667fdf7629eb92028ede", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739876, "uuid": "451bad47-5b91-48fc-93e4-283bb11701c3", "comment": "Malware payload", "value": "eb2305d012faa3301b551ff781ccd70426107e12", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739876, "uuid": "f75fcbff-99a8-46b2-aeaa-19c8991f866e", "comment": "Malware payload", "value": "af07bfee99d9070d1e5db391741e0482811324c9aea34486a011923b4ee35ab4b44f319000f8372b012456de1409a305", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739876, "uuid": "ffe64f98-c97b-4284-97b4-b6f7ebc6c881", "value": "T15075DF1176D6C53BC46701701E2ADB7AA239BD700B32C5EBA3D85D2F2E716C05A72F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739876, "uuid": "9b8bcace-249c-4106-852e-067ee32ec824", "value": "0669382b85e2c822e2ed79c439c4a076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739876, "uuid": "a67cbca4-7289-4109-97af-9a89ec2b7a24", "value": "49152:EUgbYXwB3FHjD5JPz1MbEUl8VlvfxA7vW/LL4Ni:AYk5JPpYEkMAzWz8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637739876, "uuid": "7aea9eb6-4ecb-4a14-a62c-ab42852a898e", "value": 1610240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637739876, "uuid": "fb48699a-5847-472a-85ac-5f8e30fe5915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739876, "uuid": "fefcb86a-4000-40b2-ab96-929431fa9a4b", "value": "2d8471cf29e205c9df9d1235e3acfff3d99810bdc262667fdf7629eb92028ede.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a7e99e-4d24-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637758137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758137, "uuid": "744ceccf-859a-4722-9db8-0eb22181a69f", "comment": "Malware payload", "value": "f433ef5e62c07678925918e630e93ac8", "object_relation": "md5", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758137, "uuid": "4e01a109-c7ee-46ad-a1ff-395a1f4ee609", "comment": "Malware payload", "value": "2e4abbfdf42f71ca04cfe6bfd1c857157d68c7e97d392e61553e5c3c723a1619", "object_relation": "sha256", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758137, "uuid": "b5ff5d79-a37d-48ee-872a-6e10f2cef3ea", "comment": "Malware payload", "value": "4c42b793552eaba9ec392df8735cd247c1052697", "object_relation": "sha1", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758137, "uuid": "fb7977c1-05bb-4c61-b68f-e697c7792404", "comment": "Malware payload", "value": "73fb00c19647411fbc47d6c2ed2a7c4c1440d74a55d622238a2b4960764a547c4139e83934af43b88e1051473b0a9070", "object_relation": "sha3-384", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758137, "uuid": "7e0cf4f7-d67c-4275-989a-6e4d52802b89", "value": "T1781413C8C6F961DF50742168FFC37A31E8A1F729D8BE32E1264D0A9560B59C069BC71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758137, "uuid": "c3aebad7-218e-4a09-bb98-67ade6745aae", "value": "3072:MUsWxw3CsYkUaMfI24KJ3zZ0OeN/qjSki3g8YJMvmV4EQre0vOq8c23ZBYuDAbqu:MPWC5FUaMfIeZ0tN/q+ki3MrUOhM+Squ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758137, "uuid": "b65d02d6-773d-42db-9fca-59535a61c31e", "value": 195081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758137, "uuid": "dee57aa4-6b25-4a1b-9162-cba7323c955a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758137, "uuid": "6df4bb36-a9c8-416a-94fb-e3154394a968", "value": "liberoexplicabo-6567725.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dede5c32-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637749969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749969, "uuid": "b560e231-32ff-4d24-a258-823bc25c17f2", "comment": "Malware payload (Formbook)", "value": "8825cf6bafbc04a18bbda591e5ca95a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749969, "uuid": "0f8edbbe-e268-435e-886c-c0bc3675abfc", "comment": "Malware payload (Formbook)", "value": "2edfa5f806d554457c20a6d48a519f96f8da0bf6d53e54556be1bffecbbb9710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749969, "uuid": "c9375232-d53d-4eaa-9fb4-f992b4801561", "comment": "Malware payload (Formbook)", "value": "ec77dafad266b5a8fca01d534506ed8d83fa7376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749969, "uuid": "61208c62-727a-41b6-86d0-1fe240dc7cbd", "comment": "Malware payload (Formbook)", "value": "d5524baf026c343563b7670525963bb6d13c0486a017b69230ff3773e614a91797f6947620a73b7b383c4f62bdfb437f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749969, "uuid": "5e11adbb-2920-442c-b59e-b8db66ab00d5", "value": "T11C54228AE6C481B7D7D54FB0633EB7E7E3B795CC90E85A86BB805F3628B18034605764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749969, "uuid": "ef2bcb9b-175c-4a29-8d7d-4cd2627c6b61", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749969, "uuid": "c91d6bc2-5dd9-4131-84f5-ee9a13dd4585", "value": "6144:rGiAoXpSre+wqrdKv+kXxk4m90GIXkRpWwFcXLNUScki0tqmjeqxbC0w:MoSr+qrAv+khsZEkKwFcbRbEmiqxbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749969, "uuid": "8880bf69-52ff-441c-81a4-f2028bd15084", "value": 303418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749969, "uuid": "bd7ac76e-fc12-41eb-aa8d-62a133107bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749969, "uuid": "0ac854e1-0903-42b8-ba5a-16a169ed4a46", "value": "New Purchase Order 0088870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc09e766-4d5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637782149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782149, "uuid": "09f94314-7722-41b3-94cc-96c32d5ee6f0", "comment": "Malware payload (Formbook)", "value": "f74d638dbfd6af55bd91dbea9144b207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782149, "uuid": "b7eb927e-5183-4b61-ad07-a8ae701391f8", "comment": "Malware payload (Formbook)", "value": "2ee00fc9a73fae3aa751e75cada3a45e8691a61af4e1ded00c82aa36afb5c41b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782149, "uuid": "55875c4e-dc07-4c48-b62f-a8bafaf2091e", "comment": "Malware payload (Formbook)", "value": "3fb3165500366fb573a82490b7a55fd60d39ff26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782149, "uuid": "01d5b10a-8887-47ff-8a6b-e40bc291a51e", "comment": "Malware payload (Formbook)", "value": "31dfd2aca5e1ab10ec214f4662aa8adc64168166156552e0547c8eadcc5d73f94f3d4f401fbc2bd93859b16c496c5a80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782149, "uuid": "daff66be-df1f-440f-b0ea-daa9df10e15d", "value": "T124E4BE27397DC9E2F85C3DB68649434413746D422576E21BE8AF3ED9E8333A3E6006C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782149, "uuid": "717b6551-60e5-42ea-894b-451b093f21dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782149, "uuid": "e6794881-dbd0-4fe3-825f-04c181eea923", "value": "12288:ekPFYWS0nRK9NDei0R1fiVc5vaiWT8DD7M:w0ncfDH0ffiVOeIDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782149, "uuid": "f805d72e-a561-4343-a421-e5ce724c1fe3", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782149, "uuid": "371f955e-0999-4d69-8cee-c0defb161f35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782149, "uuid": "7fe435a9-c175-4306-9637-1add118cdb0d", "value": "f74d638dbfd6af55bd91dbea9144b207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e7bebd-4cfd-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637741328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637741328, "uuid": "a72d0157-5346-4927-a248-3d5bb4164348", "comment": "Malware payload (Formbook)", "value": "2ab94e9445ebe2fdb1d5f887a8faf22f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637741328, "uuid": "5d7449c4-cc3a-49bd-adaf-c4a9ea124705", "comment": "Malware payload (Formbook)", "value": "2f25dc177ece107801390643c83b2cd626653f102df7f6ea5dc767e2b8d48c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637741328, "uuid": "10014377-1d76-4943-8504-fd7c599744f1", "comment": "Malware payload (Formbook)", "value": "61dccdc84d63f9affb0bfd353ced24b39003a78d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637741328, "uuid": "15e19ac0-3d49-4193-b79d-8adb18987003", "comment": "Malware payload (Formbook)", "value": "1d9c0b46cf4f0e2bfd084d624990279e172576c45f30aefe6f957f938069c8553d28e1e2c9b995482cb91300891c83fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637741328, "uuid": "74f4f5e0-f847-46d3-be43-d65c1cb6ec1b", "value": "T117A4D31A0885E382F920E6399163F51DCD7E3DE46B6B8A2CF563FAC8B27D849D741311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637741328, "uuid": "3d8611de-96a4-4917-9f39-8c7336a1bf72", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637741328, "uuid": "0d3af8cc-a3da-4b23-a245-74bfba990153", "value": "6144:CGiwwIdIMEfjnv5NcZ+/Z/G5jEZsKdbgpyZmugqXEUqzTZymJxJ4xFTWb0:rubbnhNdZ/Ggsibg8g2EUqn0mJv0FKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637741328, "uuid": "a795934c-f7bd-460e-abcd-eb7570eb25f2", "value": 488116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637741328, "uuid": "145298aa-937b-4dfa-9325-c42974382ac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637741328, "uuid": "55a301a4-60a9-482e-8399-30610163915f", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a4fcaf-4d67-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637786640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786640, "uuid": "5980d446-334f-496e-b06d-e4f74be5d65c", "comment": "Malware payload", "value": "dd660013d0886b4dc01586d20cdf94fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786640, "uuid": "90d254cf-3782-4364-8499-d7136288ae1c", "comment": "Malware payload", "value": "2f8005abf81a8b9012f7c1ea0bb80e0548242cd7622b7f9512879e283d01b9e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786640, "uuid": "f5cb2201-8749-488e-b1f0-6f09c5b07cfd", "comment": "Malware payload", "value": "bec7b4c93be92b15064634a98f8dde08a3365624", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786640, "uuid": "d7350efe-015a-410e-9719-14bbfc2b4dc2", "comment": "Malware payload", "value": "1a42d17f3c55feff71cf677706edd24080be33146ee4f336681f0c0cced45e589f16a575605108c8631b4bd61ca9f04d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786640, "uuid": "695b32d7-c7e3-4641-8697-4ba62e4dc05a", "value": "T1CCA4BE11F583C133D0AE1430297DD6A60AAD7D304FB499EFA7D45A3E4D742C2AB31A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786640, "uuid": "6f0085e1-b2be-4bbb-941f-f80e1cebcd98", "value": "c78edb9d5780b46eaa0956a2852d0a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786640, "uuid": "e801ada3-d34a-40be-a8ff-bb388907a93a", "value": "12288:kCy25dXCvOvAei/n8fXoueeyju1oN4uYLtyFYeOKNx2U:keAeikfXiee8ERcy6nKNx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637786640, "uuid": "68ffe449-6ffd-4f36-877c-d74815bfccbd", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637786640, "uuid": "dccc8fc5-2198-4408-b1b0-ed4f47ef47f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786640, "uuid": "c64b984c-8745-4a00-874c-6ca41989e67c", "value": "emotet_exe_e5_2f8005abf81a8b9012f7c1ea0bb80e0548242cd7622b7f9512879e283d01b9e9_2021-11-24__204354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f4cbeb-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637749631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749631, "uuid": "42f92685-327e-467b-b3fa-43d7659f6dfb", "comment": "Malware payload (AveMariaRAT)", "value": "ab7a7584564b08ddb0716a30a34cb709", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749631, "uuid": "d0553b2e-50cb-4edf-8904-f6a2d3b6ec25", "comment": "Malware payload (AveMariaRAT)", "value": "2fb8d82fc85af477d7e2fd5efae9e0a5849babe06544d5fc477972087cd2c353", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749631, "uuid": "3f5c2069-3995-444a-9457-0be5ae4d5851", "comment": "Malware payload (AveMariaRAT)", "value": "9cc36bcfca9b45894c7982f5614a72d6c1f7470f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749631, "uuid": "561569e7-3c17-41ca-ab70-e7362dd97fc0", "comment": "Malware payload (AveMariaRAT)", "value": "a5c56b25b328ad1fde0a44315724eb6ea0c32c534a85119f7a04302243913db8a5f3e54f615a30b8af81b5ea018e5673", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749631, "uuid": "b15f350b-65e4-4412-8b71-be2eb9a5b85d", "value": "T129C4D054768D9DC2D4550A728CABE0542331E60A94A3CB2F78ED361F69233933637ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749631, "uuid": "fcbacd0a-6f26-4d33-bf97-c9312d6b6002", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749631, "uuid": "dac189b6-dbb7-4d77-a00b-6863f60d0068", "value": "12288:6MrtD00GPhk/CX45x8QA8hnmPYxWY6JJ2M7cwaDHAmE0+xTS:PC0Gp4z5x8pKmPRY85cwaWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749631, "uuid": "e54506ca-09fe-451f-97d2-16f7c2e0483a", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749631, "uuid": "f3a9056b-007b-43ef-8f16-9d34d0e9e933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749631, "uuid": "c59dafa9-86da-4845-98a8-5fc305c6166b", "value": "Remittance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfb772b-4d09-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637746232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637746232, "uuid": "ede8aa96-2b9a-49fd-8f18-5259fd4cb2b2", "comment": "Malware payload (RaccoonStealer)", "value": "59a23052d75f65d26438bc881afe4a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637746232, "uuid": "5f8f8625-f08f-4284-a380-311ece9137b9", "comment": "Malware payload (RaccoonStealer)", "value": "316966b4c933f01dc51c2a48aaa04d54a4ee5d6a88024800f52be264a55293e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637746232, "uuid": "521f4aba-1fe8-405b-a9c9-b0bd7a21b435", "comment": "Malware payload (RaccoonStealer)", "value": "56f0cc39a37967ad04a35ad243b59efa2182bd61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637746232, "uuid": "2909e33c-b948-4efd-a997-1735c0227ad8", "comment": "Malware payload (RaccoonStealer)", "value": "a332a88c7d9bc149182dd828f13a329659e3f368a602e19c975bea93d692910d49e116a3caba8fcabc03d276e37057ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637746232, "uuid": "e23930c3-aa62-4c97-a175-970b9d3c1b2a", "value": "T16F353332D441FC07C918513AAE1BEA78A520BE76D8C477C6106F7C1F99B5BA1F93B218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637746232, "uuid": "67e6ba8b-54fd-4cd1-b8ed-8f4b038300ee", "value": "b8b949414a1cbbc9af7d834ae8be805f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637746232, "uuid": "c92d9fb1-ea15-4e9c-8757-92aed1625146", "value": "24576:wvV4wIOOgKyXx6oX4MxPnuzRSkg1pryUaGfjTC8cQB2LU2u7:wvV4RC5v4MxPiRgfzIQB2Lt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637746232, "uuid": "68961bab-edb8-4605-9ce0-23d405e3e694", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637746232, "uuid": "2b35572a-4165-4ea9-89cf-a3e0f18eeaa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637746232, "uuid": "b6373e80-714a-4f39-af03-56dcb6f406d9", "value": "316966b4c933f01dc51c2a48aaa04d54a4ee5d6a88024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcac065-4d42-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637771069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637771069, "uuid": "35cd7826-b936-4e72-9853-5f92bc2a8685", "comment": "Malware payload (Dridex)", "value": "716b571f24b700ffef45d30ea5619be2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637771069, "uuid": "3d132fe8-ae46-4d82-9799-1a1597cb5f6f", "comment": "Malware payload (Dridex)", "value": "31e1e38c38a3a8a418fed061d8f25da18385d0e8102818de26fcd6559e37b931", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637771069, "uuid": "e4acf0be-862b-4050-b030-838a4b25a076", "comment": "Malware payload (Dridex)", "value": "9a25f294faf15e1ea6b7a5839024bde31eeb107e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637771069, "uuid": "c8149d5c-9daa-45f9-82e5-da59edcc99a4", "comment": "Malware payload (Dridex)", "value": "469333d5238cef790b1c548baa441c1d0f41a1740fbfcffc011b297937f13b99014ff933212544979267101e4ae0c94e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637771069, "uuid": "d7a67eaf-95fd-4fea-9e01-b9706636667b", "value": "T16E53E1671A56F01BC205ED3F4E09A8B5345570FAAC84FD161470AA3B01EE1DBC7EE16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637771069, "uuid": "6dad92a7-5d5b-4b6d-bbb3-3b82570d399f", "value": "1536:UWjPIbZ853SAJbpklM933f91Riu+fDmTgdS2:VUbC9km9VnipbagdS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637771069, "uuid": "df651392-f47b-4127-a9c7-464ab21da54b", "value": 63598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637771069, "uuid": "eb014d93-01ef-4a42-b70c-77fb032e2582", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637771069, "uuid": "c1446467-62ad-416f-99b0-e8c456510c37", "value": "request-377185.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ab579c-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1637779058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779058, "uuid": "f494e66d-7218-40aa-b964-bf8bf7d53669", "comment": "Malware payload (Neshta)", "value": "8143715a1bd2d95dfc59081dc09ad5c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779058, "uuid": "78e09163-b3fa-4213-829a-82f2d014e063", "comment": "Malware payload (Neshta)", "value": "33702123367a61205015471b83b3746161f9b85b0a5106bdee6f7b7bf18d65c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779058, "uuid": "16b0449c-0bdb-4e5a-83c2-eb2aa33ee784", "comment": "Malware payload (Neshta)", "value": "72d6b1a1e45fef17b0d4bfb9e9a9d47f1ab6a169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779058, "uuid": "376b0b0f-7136-4715-8f0e-e7993b3e4dd5", "comment": "Malware payload (Neshta)", "value": "043ffa863388cf6a5333bc6ed2fa25f78a893362c8c49440527d2db89794f85145fff6177bbb1693fef781ef0d4eeb2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779058, "uuid": "8943c7df-7e19-44c4-a922-daf38d099dee", "value": "T1CDA4DF4539D5D1B9F87BEBF90CB8B2C80335F2E5EC51F2DEE990285A88A27954F04532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779058, "uuid": "267f7904-f814-4577-aacd-b49498b49c3a", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779058, "uuid": "d32c0625-8e28-4a20-8b80-d03f71eb2ac3", "value": "6144:k9VcIxoM5THMo3EyIW5BBwlc/AQLO/uZpOwtPn9h1wZm3899CIhLurewW:0hCoDFfBucYCOwZ9h1wtnDLu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779058, "uuid": "48eeb7df-4fc9-41a0-a851-b60a09f7951d", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779058, "uuid": "0958a0fe-86d8-44f7-ba70-ece3975d4fe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779058, "uuid": "e4e50c9e-2c91-42b6-8994-8928055dd5b3", "value": "8143715a1bd2d95dfc59081dc09ad5c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c7efce-4cc8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637718337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718337, "uuid": "e4b9d524-deaf-4492-aa0e-0c592f447718", "comment": "Malware payload (RedLineStealer)", "value": "7a77bf3cf682a68fbdbd07668fdc169a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718337, "uuid": "9e080d33-5459-4305-95a8-78c98946789a", "comment": "Malware payload (RedLineStealer)", "value": "33b95d37a5798d22164b77968c99f8d0c1925aad08daa0f200a365f87353f160", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718337, "uuid": "5dbdfde9-508d-444a-87ae-285e58c6ecf2", "comment": "Malware payload (RedLineStealer)", "value": "4c57a505f8fde4d3a1ae447da330d8cc670ba204", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718337, "uuid": "f3fc2ae3-bdd5-4ca4-8d84-7f877e0c6121", "comment": "Malware payload (RedLineStealer)", "value": "dd3c921592f6030441942e5de1ef4c5c8cb4662fa858d54c5667936c7458f4a934917e84d0b92a88f997d41a87fcf6db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718337, "uuid": "2ee9f5fa-44d4-4f36-a89b-f0bfb6a939a5", "value": "T1ED54F1213FB1BAB1D8E3D63124708B51DE3E7C666D7581472364263A2E752C08B7E36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718337, "uuid": "b40a1d48-3226-4013-8a47-55f4e4b95ab4", "value": "a2592ff0cb9d4716be385a37eb0faa8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718337, "uuid": "152bb4b8-1dfe-4877-adcf-6b7bdd4f1156", "value": "6144:DrDzpkavrad6Zs2Mo24RLvk+ezcznsNOeo1c4:DX1kaze6SFo24RLvk+dTYOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637718337, "uuid": "e3109211-81d7-45bc-90ee-585ec54b050c", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637718337, "uuid": "bb9c321f-89a1-467e-a174-1f75f3e649d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718337, "uuid": "81c092cb-7759-4b2b-a6ec-33bbe7c7bd9e", "value": "7a77bf3cf682a68fbdbd07668fdc169a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eac0bf0-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637782315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782315, "uuid": "5cb01a4b-a733-45e8-a7b5-8ba77d0fee68", "comment": "Malware payload (AgentTesla)", "value": "be85fcba0a33819b3e4a825905fb4b51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782315, "uuid": "e20df403-274a-4543-994a-339f2b46fa5b", "comment": "Malware payload (AgentTesla)", "value": "346a6e2e8e1312c55af66a0129b44083906a095014dcbacc748b6d261d8586f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782315, "uuid": "743bad3d-a011-48f5-b299-4d627c9627a0", "comment": "Malware payload (AgentTesla)", "value": "ede2fc33316feb94a554e54d5ee9494c0fad60db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782315, "uuid": "86d043ce-6ff8-45d0-9ea0-da5101a4c43e", "comment": "Malware payload (AgentTesla)", "value": "d226a9b9d085ee26512cbe1556860980545466fe9c3140a6acee0520d1aaa07c45933d81e103589c7b7eb4bc4d3bb276", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782315, "uuid": "c5483ab7-dd51-4395-ba99-bd0bc3be6faa", "value": "T1C3D4DFA83250B1DFC85BCD368DA46CA4A7217467570BC30BA447169DAE0EADBCF116F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782315, "uuid": "89be6186-ac81-404f-b8c6-3e91ef904786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782315, "uuid": "afb3efa6-42d8-4400-b38f-21ae3299e557", "value": "12288:3f1o/e9JUcXyQKpYMDW46683D2IkcJkeueewfgcySE/XtD00KuGEVvA4ac:3fm/UUV4G83D2IkGNnhocyVC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782315, "uuid": "7bea03d3-1e71-46b2-b7bf-4aa068f9da46", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782315, "uuid": "89a1ecfe-290c-41ab-9ae1-8f88780dc7f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782315, "uuid": "bdef249f-a497-4f87-ba06-a5bb3ba1ce6c", "value": "Shipment Notification 1753142378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae1b89d-4d53-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1637778174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778174, "uuid": "eebba755-7549-4f8e-8a42-ee2c70e7386f", "comment": "Malware payload (BazaLoader)", "value": "91a7b1a06eb6952d69cff84994fd936c", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778174, "uuid": "ca591ee0-8053-4acc-a8ec-f1f762084b8a", "comment": "Malware payload (BazaLoader)", "value": "3519764cca01b0ae940c0357718f95351a893967008a2392c5e043eaa7bbfde2", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778174, "uuid": "0bcbc6f4-1782-4789-82b4-a4f1c8e0fcbf", "comment": "Malware payload (BazaLoader)", "value": "dc525901c20238a9e22e878c0a6bccdc098147b8", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778174, "uuid": "e607b3fe-8149-427a-9137-628d010b530c", "comment": "Malware payload (BazaLoader)", "value": "13b756ba3b0cab42471dcc773e477784430c24f802806244efef9f177106da3c2ba430fd6732702b6e9e8c02bae552c6", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778174, "uuid": "2ad569a8-2c5f-4808-bd11-72bbec2d5bbd", "value": "T19D64C0117BD48C98DD77027D88B34805DABE2C325B35AADF0A74259E9F6A3C14C3A778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778174, "uuid": "9d3e0c02-5ce5-4447-b61e-713f72cb0207", "value": "b01abbf9bba0f1daf3b4d5629e6a666e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778174, "uuid": "eec639c2-3809-47c5-bcbd-2d01224d6660", "value": "6144:bV/R1DGqitdh9BhgnaTyEJle86HEJwDdVU9wGtDW:hJ1DruhmaJl1HJadBMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778174, "uuid": "00e48f36-1e99-497f-b62c-d4d85e3a7541", "value": 311821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778174, "uuid": "1925103a-c7c8-45b3-b615-af5da2cb1f50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778174, "uuid": "7792c79b-26d2-411a-be02-173670927d06", "value": "3519764cca01b0ae940c0357718f95351a893967008a2392c5e043eaa7bbfde2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9039c2-4d7f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637797053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797053, "uuid": "f00548bf-e702-4b6e-aabf-c1ee3b530403", "comment": "Malware payload", "value": "f21e2e3f66093f29bd421a7034057ed0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797053, "uuid": "6107b189-6a46-4470-969a-f1556a0f9ba4", "comment": "Malware payload", "value": "353e8efbfa1586ae7dc457b6840459fb64ec0df10387154d18e7adbc8a3133f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797053, "uuid": "90b84c7d-35fa-42a8-b24b-f43c8a1c8def", "comment": "Malware payload", "value": "77e66ed53d4a3f1b03da1ab3f6149f5d19169327", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797053, "uuid": "b1024a3a-4bea-4ac5-9c10-94682e4f1360", "comment": "Malware payload", "value": "00a3cf0a8a7b32489641e9ed1dc3477fe9e7dabd80dde695ff83bcfe81e180365c9c90fb8ef117f92afa83ca77326ed5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797053, "uuid": "a0ebd0c0-6f94-4a29-acc7-54a9f1d85181", "value": "T1646533E77701F10EEBE93339E2B4571CE1FE0382551AAAF902988E8734654D5D8066FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797053, "uuid": "9bef4ef2-cea7-42cb-8702-c302becb2f11", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797053, "uuid": "141e67e0-2eb4-4cdf-8391-d73413ccfd89", "value": "24576:ZTr/r9F/S9Fy6NnWrykCeMrES5TaRCnhAnOsUzzOeSkEaHNYK3h5rqGC7:drDz/SFbWFMrESeCn2aPUNaD5rXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637797053, "uuid": "0d2b2ffe-1366-42f0-8b2a-13bb05773d0a", "value": 1416192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637797053, "uuid": "b6823ddb-83c5-482c-8efa-61e973480839", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797053, "uuid": "d4cf9929-2455-4d5b-a310-0c26f595d049", "value": "f21e2e3f66093f29bd421a7034057ed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae42eee-4d3d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637768779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768779, "uuid": "b00d273d-6405-4a24-af73-68dfb680237c", "comment": "Malware payload (Heodo)", "value": "145a3e1678b2367ac018f0d9e1bd9c73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768779, "uuid": "1e9ff4e4-b139-4e84-a8d9-76302bf0c700", "comment": "Malware payload (Heodo)", "value": "3563c9d1361cb4e8151a46084a33d15d2d9964e58c4df81f905ee2f9c99d082d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768779, "uuid": "90d33fce-edfd-46c6-b71a-be343dd91b3c", "comment": "Malware payload (Heodo)", "value": "8bd4dd0f0865a1f0dda3ba5afe703695b32a7c81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768779, "uuid": "a5e2a88d-f3a1-4129-81cb-37ac3630aa72", "comment": "Malware payload (Heodo)", "value": "96be9ef1bcc5d87e9db9be302641b5bd8b4faeed8967a6c5e638729487dca9a3331d8dead5ce3cff7a2fccc0fa6235f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768779, "uuid": "ae0d358c-9985-45ce-a70d-65e76f3956a9", "value": "T1ED949D1325EDBDE2D5B9173037BBC7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768779, "uuid": "e28c6d07-c768-4c23-bace-877e9e34d23e", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768779, "uuid": "8e550b93-c8b8-4f92-a88f-dfca89debf0a", "value": "6144:1ACzUEcRRKxe0DUAldEzpLbE0sepO8+wM:1lxemHQtbE0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768779, "uuid": "c9b2025f-af9e-44c9-91e0-a9380458f1c4", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768779, "uuid": "fc726132-51da-4f53-a97b-7e4c0012577a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768779, "uuid": "182b0244-8b5b-46a7-917f-70b870080978", "value": "145a3e1678b2367ac018f0d9e1bd9c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfc3473-4d49-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637774069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774069, "uuid": "bd74ea17-87ee-42f7-9d8a-9fbd647bc32f", "comment": "Malware payload (RaccoonStealer)", "value": "8269c5ada245e192cf0b239b3d150d9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774069, "uuid": "5efe4d8a-400e-41ea-9f40-7637f01032fd", "comment": "Malware payload (RaccoonStealer)", "value": "358213944e6ffaeda3ad6b0b9bc47c510eeb45361e41f2cbbc39803232254725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774069, "uuid": "765018e7-3433-476d-8b4a-1b2a8abfa8ee", "comment": "Malware payload (RaccoonStealer)", "value": "13aa737b8df9ffe64644601825c0302cc35502f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774069, "uuid": "3a7e389d-7e4e-499a-a6f0-f6445a519d54", "comment": "Malware payload (RaccoonStealer)", "value": "7120c1e18ed421de5b9aa55daa834686038738e85b5145951297e769b456c014ecbcea4069e35fcf095b96bc26acdee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774069, "uuid": "67cdbc53-fb20-4f4e-8f67-ec3cd8c1eeef", "value": "T1989412217652D038D5F225322878EAB10AF77D136A75024B2B4A5B3E3FA07F059BE357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774069, "uuid": "3c21d227-4fdf-40bb-920e-a4f21ff04d3a", "value": "bf61ae69989d1072f08e18d6fa6b3469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774069, "uuid": "b7f5ed00-0600-491e-be01-858b2ef1849d", "value": "6144:AESy+ZlUg8bQKzZcSvMKL49qCO6k37FEPzPk2UpArjDw1ZEWViPZNBfG++iN:rv+7lxILRP37FEPzPwArjYZEWQxXF+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774069, "uuid": "7adf5609-cf4a-4e17-a5ab-07c148b1dc9c", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774069, "uuid": "5be8efa3-ef50-4821-8919-6c1f125b58ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774069, "uuid": "715c1877-8543-4077-a18d-0c1bc4db3ee1", "value": "8269c5ada245e192cf0b239b3d150d9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e869ea6e-4d24-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1637758145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758145, "uuid": "a555aee9-93e9-4f4b-9045-66e0dfabb897", "comment": "Malware payload (SilentBuilder)", "value": "22b0de333aa003ed778ef6ceba91d6a1", "object_relation": "md5", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758145, "uuid": "d3b37c12-61e8-482a-88c5-34d49ebf0057", "comment": "Malware payload (SilentBuilder)", "value": "3680ad73721f1c1adfd8f522684b40f7e3d4a9d209a94f416b92f4393162a024", "object_relation": "sha256", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758145, "uuid": "d4d87342-bbc8-4f40-94fe-b2ec21602093", "comment": "Malware payload (SilentBuilder)", "value": "9465292c0805655c5bc086537c336ba720f3d8e5", "object_relation": "sha1", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758145, "uuid": "622b7ff3-f6e1-439c-9f32-2964afcc4528", "comment": "Malware payload (SilentBuilder)", "value": "b3d459b1e22c0d84fb0f90ebbbd3dceb84f3abed97045f08c8a4a1b46c6108e60f5fad516c3aaadb4ba7f5f9dfe3cb6d", "object_relation": "sha3-384", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758145, "uuid": "15ca14a5-04fc-4c4e-abdb-b96de597660a", "value": "T1D834E146796CC8DEFA57833148D75BAA6333DC204FD71A876AC9722C6FB4DB47912006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758145, "uuid": "f0480fc2-f483-4446-8521-e1ac9be10b4b", "value": "6144:MKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgwcfFw6lxFT7kFWqOSMQ6HujLmH98DUf:tFrlxFTMrvbiFd8Da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758145, "uuid": "55f478a9-fab6-4e11-8dde-69430bf76bdc", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758145, "uuid": "94d496b8-4fba-4809-a45a-3da9b819b7c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758145, "uuid": "acda7c34-ac41-4468-b93e-3f8435d1d758", "value": "private-1910485378.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c619e60-4cd0-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637721698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721698, "uuid": "3402d8f7-3f2c-4c31-9be9-1aa01fff3994", "comment": "Malware payload (NanoCore)", "value": "de2d175988e8d0e1d9c37482fb37c66c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721698, "uuid": "f5740234-3740-4524-acc5-b247c72f4822", "comment": "Malware payload (NanoCore)", "value": "37649a092c0ad878f4fb8d8578c2e7ca110360ba1575e0697baf1efa8e5cb409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721698, "uuid": "b3b9bd74-593e-4f74-adb1-322053450030", "comment": "Malware payload (NanoCore)", "value": "d4e7bacea5b7ee3deb72f73cff98b286661f612e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721698, "uuid": "4c20fdbf-107b-48c3-921c-89d90741d7fd", "comment": "Malware payload (NanoCore)", "value": "90f3d56ce00d7c11f4b14fdb4791b61df507001cda313106a41a3c94aa41258a314b9b218c043a4699532fe010a34384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721698, "uuid": "783f666b-0cf8-420f-8a0a-6c7a54c0dca1", "value": "T16394023132B5A753DCB66BF508247284137372563E11E75C9CCA22DE2D66B228B227B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721698, "uuid": "11f7a595-45e0-489a-9202-26622ad9db7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721698, "uuid": "7bd1950d-a051-4fa6-91a9-d80f30a2a521", "value": "6144:EimL+T2bm+Ds2n+/10GrM2cwktwooxz6MuDHWfqvfNP80/lg82D6F2:7Q5yDY+/1tcwYa6HD7vfa0tP5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637721698, "uuid": "4733302f-e03d-4eaf-b596-22b24cf93bef", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637721698, "uuid": "854743aa-8d71-4653-9480-5f8a535c1e27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721698, "uuid": "1b075e10-6aed-44cc-a115-8102064f6b73", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06492a30-4d62-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637784394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784394, "uuid": "4acfd6b8-2f7b-4ec5-952b-8175b6c2253c", "comment": "Malware payload", "value": "0b7541d6129f823c9f3c3b4a35c8d28c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784394, "uuid": "d842a30f-efc5-4280-93dd-d00b9a02528a", "comment": "Malware payload", "value": "384800dc0da023be75e319184ad44a14d9402f82f4d0a08a86ff7ab5d462382d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784394, "uuid": "1dcc7411-e9a6-4bc9-92a1-952076ee45c9", "comment": "Malware payload", "value": "c70fbda37fc8afd19165fbbc3e361dfd73611798", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784394, "uuid": "00edc112-2c43-41b6-946c-0802636e2c5a", "comment": "Malware payload", "value": "b4ae286590a52ac1fefdeacee50c3dcf1e5d44421cffd1b2378be44fbcd50fd6f180829dd4a69f0f1879bf2932a3bc9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784394, "uuid": "95c07c44-ba92-44e4-96b0-fa0c5c222785", "value": "T15C8312CBD9620907FD90E033CE18B8199F75C66C46CE6F8F0A99150328726F1E9E8DC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784394, "uuid": "087a3e7c-0e29-42a2-9f7d-4ad6e41e0a1a", "value": "420650f1cbd7de75a149f7fe04a5dbe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784394, "uuid": "e861ed2e-cd2a-4d52-8e54-f8685dd9a095", "value": "1536:SA1Ng+Tqn8wAFBVg5WFdAMlr6BBQ9xOnCHnKuf4azWEBYgH4uTL4TFQZTntjFZmr:vNun1AmjMlrEV6n7AaLBYgYuTpnhFZmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784394, "uuid": "39eae969-b94b-41aa-aa6b-57f54e1e6252", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784394, "uuid": "af9d0b93-0578-44bc-950b-2fd96936d149", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784394, "uuid": "8e8cf4db-3f9c-462c-bde9-7425ef8ee824", "value": "0b7541d6129f823c9f3c3b4a35c8d28c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0129eb29-4d32-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637763770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763770, "uuid": "1700b7fb-d437-408c-87cb-c13253c297fe", "comment": "Malware payload (AgentTesla)", "value": "a330262a580b19a3b9d68af5af4bb7f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763770, "uuid": "2bde84e2-3a42-420f-837b-b8a6d18c562f", "comment": "Malware payload (AgentTesla)", "value": "38f0ad3a2b758678aaff9ce21e6543ae585504154d2e0b284a447117fc6eeab5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763770, "uuid": "021dc1d5-3986-41bc-a4b4-b21f113ce6dc", "comment": "Malware payload (AgentTesla)", "value": "539ec32ca890027919670071e2fe6a05b3750b35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763770, "uuid": "d22224c2-8cc0-4848-adab-2dcd4231b663", "comment": "Malware payload (AgentTesla)", "value": "aa332c614410d1743de772343550148583133f607c66f93a286c90056581a8027db72bf5da798ac9e754512049498586", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763770, "uuid": "38893a43-8105-4909-b052-f31db63e9e4a", "value": "T1208423734CD8D73EDA67C1D63885DFDD6695F31FC60B9A0B3DC042A21B0A9A9AC16D10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763770, "uuid": "b87b2a27-1cf5-416d-8c01-3464ed3ead00", "value": "6144:PgvM860z3jDzj3krXi9Hq9JLKIo35mFafgpZh+zeB/85G1Nt+zr:4vdX3vzj3krXaHKJWIG5mFf+z6UmNszr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763770, "uuid": "c7d810b6-cff8-49ce-9533-786f101a8c5b", "value": 403649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763770, "uuid": "5733be24-f72e-4544-88c2-9f3372041a59", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763770, "uuid": "ce472b2a-aaa1-454c-b4e2-649b5aeb1f8b", "value": "Hsbc swift.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e078b6-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637775859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775859, "uuid": "eee7f390-20e2-45ff-a30b-307ac44c4fbb", "comment": "Malware payload (Formbook)", "value": "1da800c8650d9f532a52a4181cf860fa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775859, "uuid": "63827941-1e0b-484e-8622-b38beff9825b", "comment": "Malware payload (Formbook)", "value": "3917f8bb6032e0bf4495305ffa20cb036c6792dd9054c62ba5e541663c1a8f8c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775859, "uuid": "589ab964-4e37-4eae-a4c6-996142da8a53", "comment": "Malware payload (Formbook)", "value": "fa8e14dde3645ef59b58cc2368f2c100546ba6fe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775859, "uuid": "1861839c-b09f-4715-90ea-a7f4713308ba", "comment": "Malware payload (Formbook)", "value": "106b9b190bcedb26aff64ab728525b5b86ce5a2b58d3c7248995c669d4b6f89004e06ecf7cfbdfa7a76320ea3521acad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775859, "uuid": "48b8622e-d31a-4221-8c33-f63fc4ada008", "value": "T13634123EF5C6ACAEDCD09773C96CCE61421FDD13041298B7A17D3C2F86B8211A910EA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775859, "uuid": "192824d1-9ed6-4be8-a1be-8c1e8027d942", "value": "6144:F1oZH1SZARHXFtFMqJ0h+EHTUmIfx5alHxK:F1oZH1SZAz3Jc7TOx5alRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775859, "uuid": "12083ac5-378f-40b3-8c9a-bc141108dffd", "value": 234456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775859, "uuid": "99c139cb-80ab-49e7-9926-078a7667568c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775859, "uuid": "5364d3dd-e2cd-438e-b7db-8879d3e426d2", "value": "470601.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db6d458-4d3e-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637769079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769079, "uuid": "07ddc151-9613-402f-b61b-c6007d4b522b", "comment": "Malware payload (Dridex)", "value": "855f1e91d91b3dd2e5000569c06a69e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769079, "uuid": "15d42bce-76c3-4d6e-b7d8-37580716ef7d", "comment": "Malware payload (Dridex)", "value": "3a35cc9715e5b43fb77e010891e1f8e70137a12496749cb1ef9c5174fba0ec5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769079, "uuid": "2b7e60f7-e53b-48b0-8252-9f643430e378", "comment": "Malware payload (Dridex)", "value": "9b54791a1b1381d48b78ffbcabb08f0035e31a4d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769079, "uuid": "ba83de9d-0763-4fdb-b9e6-2e23fa495c9d", "comment": "Malware payload (Dridex)", "value": "1b6485271fea010281c4ab10e035fb4b052e6d13106030f84f79c282b2bcb64c1622c81fe22054e714d819ba4eb71ab2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769079, "uuid": "482f91ac-aafa-439c-91ef-174cf008260a", "value": "T1BF83021D098A34E0CA61FE3C870E14B37A9727695E40154F15E8BBAC8336997EF5B12B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769079, "uuid": "ccb69f81-14f6-499c-aa1b-a15a79df9b0a", "value": "1536:UWSPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5h04YPg3NnyiGu8bHuWgd/2:V6qmc3/q0dfaguKydYPg3NrGu8juWgdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637769079, "uuid": "2ec2ac32-3ee7-4f5e-931a-b7039e17935d", "value": 86785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637769079, "uuid": "f3fdbb68-f6c8-4142-86ca-d6022ebb6568", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769079, "uuid": "ca570fc5-6582-4c13-8e5e-657815942c35", "value": "hunting license-25331.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b80444e-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637782470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782470, "uuid": "281c2852-1da2-4052-966d-154cc078b405", "comment": "Malware payload", "value": "f185773457186cbeda1360c3533122a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782470, "uuid": "31131b7f-be0d-4aef-8538-8c73cb20c535", "comment": "Malware payload", "value": "3a59d799589143527ba6319064b80d6709472e35fddc17b75f3da567d71ec3bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782470, "uuid": "f77ed7fc-5950-48b3-8bac-49bd20d9f975", "comment": "Malware payload", "value": "42c6eae2795cf4ca2574be805c5d0bf0dc2e31c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782470, "uuid": "ef1812d1-6c69-4fe8-a8c3-54fba1f6455b", "comment": "Malware payload", "value": "a5db4642b3e04a81f3193275f16d2ebe20b27604b2df3ee13930f3bdb5d681f3da102d0202b5b19231b4b9db41cfaa97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782470, "uuid": "8744ef9c-f6f8-4b9b-bb46-ca617c584462", "value": "T1A8D3AE2177E0C435D1972A3268B0E7604A76BC327B71868F3BA4173F1F702D19AA579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782470, "uuid": "42fad509-e2a6-4234-9ed3-fafdca5b9e03", "value": "7fa5c9c2dffd615fa15cdafc116d6f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782470, "uuid": "b0de858a-49d9-4ed8-aa33-38321bc1cd99", "value": "1536:pyUem3fTUaSfVzc4mniZoGfaaJFmuyifAchU5ZAR6pI/ozppf4navdRn2:wUeMYjN5TTFYeABK4yqpwavvn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782470, "uuid": "dc38d6e5-a51c-404a-9b27-45864e9245b3", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782470, "uuid": "96c8999e-190c-49fb-96d0-66f750c67f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782470, "uuid": "2ee79d1f-ccf5-43a9-9d20-6b2f45e8d0f7", "value": "f185773457186cbeda1360c3533122a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e536c5-4d3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637768214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768214, "uuid": "1734d61a-6f8f-422f-8cd2-f9fd8492ec5b", "comment": "Malware payload (Heodo)", "value": "b65325cbe036c4e86a94428d8e7fab49", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768214, "uuid": "f04e5d21-b912-4fa1-8528-13064c376938", "comment": "Malware payload (Heodo)", "value": "3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768214, "uuid": "7b962ebe-7a01-4f34-94be-ff0bc273e772", "comment": "Malware payload (Heodo)", "value": "8788e13d2a0fad0a31f5a48613d2fcbd521d0d2e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768214, "uuid": "c6927d3d-6da6-41a1-857d-19354cda74fb", "comment": "Malware payload (Heodo)", "value": "72aae5a225ab6fe64f097ddc7932791fda966044c4e8cee02809f80ee2fc60883a488ec5efd6062d303a8b14ac5805bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768214, "uuid": "8c6e5fdd-c919-4faa-a536-a4842f091bb1", "value": "T11D949D1325EDBDE2D5B9173037BBC7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768214, "uuid": "ab7f0471-7546-4f4a-8564-557f2382fa0e", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768214, "uuid": "a92c5d3d-ebb8-4c2c-a7fa-b4ab8a9618cb", "value": "6144:1ACzUEcRRKxe0DUAldEzpLFE0sepO8+wM:1lxemHQtFE0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768214, "uuid": "efac8544-1ba6-48e2-9c8a-f59fe0a1eae5", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768214, "uuid": "ab15054c-67f4-48e5-8885-541f700cc962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768214, "uuid": "dbc7c439-9b76-42cd-b46e-454d4c5ed5a1", "value": "3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a83c441-4d28-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637759491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759491, "uuid": "52a4a3ba-6531-4b0d-be04-d561d045c4af", "comment": "Malware payload (RedLineStealer)", "value": "7651cc404141826708692add68372524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759491, "uuid": "60cca82b-aeac-4da6-8515-2fc10b5877d9", "comment": "Malware payload (RedLineStealer)", "value": "3acad0abd816310f3799e2597c8428a89c0f05a6912167517bdeca21bd53011c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759491, "uuid": "5554c382-a2c7-4b39-9363-6e288c0622e0", "comment": "Malware payload (RedLineStealer)", "value": "97ed4def9185bc489ce2b8cdcb6eb7664dc09265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759491, "uuid": "b3b7e4f3-2c3f-4c9b-afad-512b0fdc3e27", "comment": "Malware payload (RedLineStealer)", "value": "de7580bb0a7e5efcf45e43fb9434df56da349bf84656a355382d2c7086800a9547d77ef5a8beb7f1700477aeacb4aa08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759491, "uuid": "b66ea9fd-a641-4ac0-9857-fb4ec924e156", "value": "T1843533639E56A877E630CFFB8B55B237F8E4430A1946321DA1ACDFC9A14E641CB12C53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759491, "uuid": "84da8e66-bb4a-4791-9683-483aee1da9d7", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759491, "uuid": "fb80122e-02e5-4b9a-a562-c968b3e8e71f", "value": "24576:R4yPfOxA+wCjkoA4NYZpowasAFUE9Xer9DWf:R13Om+wIRNYZpowax+9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637759491, "uuid": "e18a15cf-eb56-4ebc-a75c-5560d6278c42", "value": 1160584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637759491, "uuid": "e96ac015-02c9-4350-b51d-1592ae8f9e0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759491, "uuid": "5986495a-f8a8-4fe1-8990-04aa833b9d70", "value": "7651cc404141826708692add68372524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097b9e50-4d13-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637750470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750470, "uuid": "98a24760-7282-4c26-abe3-4715db08a35c", "comment": "Malware payload", "value": "0e3779d7a8dde921cb96dfc47b4498a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750470, "uuid": "36810337-f269-43cd-8dc0-01b41745d486", "comment": "Malware payload", "value": "3bac16b01fb24d6ae7ea84a98f345dba695e43bec707c64448d514ab192b8711", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750470, "uuid": "a0068d5e-44cb-4ca9-9e7d-858715f51274", "comment": "Malware payload", "value": "64a0e19bdd49418127a6be58e29b468fa964a604", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750470, "uuid": "6d5dbf8d-60fe-48f7-8c3a-a7689804fd86", "comment": "Malware payload", "value": "2f35bf332bf57aab26a13d6d0ddfc213bebb1cb449742fbf754c00e2467da113ce1da8eb36ee135d324d9078e6cc7f63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750470, "uuid": "7391bbde-47ee-4dc3-8538-607164fc0f38", "value": "T1CC92A5057296C253D2981E338CE6EAEA7339BC41EE8583173188777F6D7AB54CE52301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750470, "uuid": "3ba19c49-863e-4122-b810-ae48520688b8", "value": "192:0BZX/5Qr+ZhmYAINoojI/8GM/kayZElGxNdiwxTNai0s0tbXLWI2mA5c/:0PX+KRIkG4kayZElGxNdLBai0s0xy/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750470, "uuid": "9aca9a93-0097-492d-8431-bf71694b99ec", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750470, "uuid": "4e6d343c-39c0-437e-a4fa-9edbc3c0d645", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750470, "uuid": "aabee712-feb1-47f9-ad5f-78b638db1260", "value": "hdgfhdf.c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0331216c-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744446, "uuid": "fdec4545-c4eb-4bb5-b806-9493a97798c7", "comment": "Malware payload", "value": "d802f4ba93bd4dd264886e4943014b69", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744446, "uuid": "27a5782e-611c-491d-b96c-3d23268981e3", "comment": "Malware payload", "value": "3c073f62cba6aa600ca684945d5aa69a90897ce4e5458672ee868a4e8df35946", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744446, "uuid": "bb1ae82c-59b4-4da6-8894-af11f3b6176c", "comment": "Malware payload", "value": "598f51deae08c6e682a11655d14c43aed0e6c85d", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744446, "uuid": "e71c8691-0e22-41ce-83ce-5d42f032e316", "comment": "Malware payload", "value": "baa8ecc5bad4d13e03a6a19b2f22aefb95eb92349d46e8df1645b81583841f6beb4bc9529265d03f7acfc7d8ad9d9560", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744446, "uuid": "6d168422-26be-4280-beda-87b5052b4e63", "value": "T159B5330C1376BCFDF85E02293B634ED1C5B9A1E1F5426192D26848A85C3F5BD13EF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744446, "uuid": "290b3b02-6328-4f49-b98a-4b103e2a1506", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcE:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744446, "uuid": "efac1265-f6b3-44e4-8466-91c5173ceb13", "value": 2387968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744446, "uuid": "f5b2ed15-0706-448b-9bb8-5da243165863", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744446, "uuid": "fb859add-3db4-4a55-bc3c-d7cd70920049", "value": "3c073f62cba6aa600ca684945d5aa69a90897ce4e5458672ee868a4e8df35946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1760398b-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637749634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749634, "uuid": "ff6e5dfa-730d-4420-b6f0-cb6c5071ae6e", "comment": "Malware payload (Dridex)", "value": "6bc444739a91a4dd8085d6afb15deab7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749634, "uuid": "d86459df-b5c6-4160-924b-f6635cd65cfd", "comment": "Malware payload (Dridex)", "value": "3c764285f1b90f75f619666d6b3b68398cb8c13691f2495e062ded94a61d2fa5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749634, "uuid": "ef22653d-8933-4bba-8ecc-f7168a63bfaa", "comment": "Malware payload (Dridex)", "value": "e81168586350f605c90a7fe481d78d323bb108fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749634, "uuid": "3c61cc04-3ac0-4299-9e6a-0ab4d0607210", "comment": "Malware payload (Dridex)", "value": "a38e76876b39bcd3a57605f0500bf910bc772fc068f61ff3dfc3ddaef51087655e05e929a86434ae56437f7a87dfa597", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749634, "uuid": "adaeb654-f91e-4f3e-b06d-90e49cc4d181", "value": "T1A963F18ED0D6F125D3429EBDC77948E193161EA3E525A69B1884B31C7FA73834FEE009", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749634, "uuid": "be8a4bff-d164-482b-82b1-3642e5636862", "value": "1536:UWbPuALLImemeKHqeK7YncAZwn0Fh5MaFucgrTgdyn:Vy80XKUYr0C6akckgdyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749634, "uuid": "d1ce03bc-ca89-4629-a668-748df7538c58", "value": 68506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749634, "uuid": "bff2dac7-15b3-406a-bf25-4e1d4378562e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749634, "uuid": "9d22184e-a28c-4991-9701-7a4dab0980bc", "value": "Rooms_requirement.4715.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41e9633-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637763668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763668, "uuid": "9bb17193-5994-4ca6-a6b0-1bccdaf6ada9", "comment": "Malware payload (Dridex)", "value": "59e91382afec60999a8488a9669f3fad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763668, "uuid": "485380fc-ca93-44c5-8451-123ef3d89927", "comment": "Malware payload (Dridex)", "value": "3ca84e83371763b477791f930f80eea0d2989ace6cf7c765e90a8f4f28e893b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763668, "uuid": "5a786231-7f4b-4022-a05d-04cf55b523d6", "comment": "Malware payload (Dridex)", "value": "5a74abb150f56ca71b2fcc62f60418ddb0bd0449", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763668, "uuid": "96edab35-7751-424d-8231-dcf69eea220c", "comment": "Malware payload (Dridex)", "value": "61a4e2881426d1961dd6a6ea7bfcddb346f037cff183b89ab1575f159d237ed0122d6894c31898fc12cd015da492e433", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763668, "uuid": "c087cd6a-733f-4d72-8d41-b0becc30a90f", "value": "T1B063F19DD1696588C36D69B9A84E1FF1340A644253C1832F1CDCAF191B92E8FDF1E23E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763668, "uuid": "2a4276a1-0978-4e23-a45a-6ec518c33b96", "value": "1536:UWaPFwJpvc1e+BwT8YIbDMz+1d6xIzm7CO0MBeCMkfUWsgd4:V9MrbDu+1d6x4m7hCkfogd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763668, "uuid": "5a8ecc7f-1380-4189-b52e-02b90cc5a1c7", "value": 70801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763668, "uuid": "a7dd5ab8-2438-4257-a603-55af4f5023cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763668, "uuid": "c9e348ab-d193-44cd-92df-a2fa365a81a7", "value": "payment_646921.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbaaa3a-4d33-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637764382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764382, "uuid": "382e72db-c94e-49bd-8c37-24003c56c2f4", "comment": "Malware payload (AgentTesla)", "value": "53c03551d3bfd0920aeeb26906dc1f54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764382, "uuid": "07225b23-fd06-46bf-a2b5-c59ed090336d", "comment": "Malware payload (AgentTesla)", "value": "3ce89d21d6311baed97e4d5c7385bb4ca926d7567abc6f8ec72ece25aa75b385", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764382, "uuid": "9bec2921-6eea-4b14-abd8-267d528eac63", "comment": "Malware payload (AgentTesla)", "value": "ef95de2e91f37d0bc2a369bf2bdb9d6084137653", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764382, "uuid": "afe264f2-a779-4202-acd2-49a172e48deb", "comment": "Malware payload (AgentTesla)", "value": "8c0511c83b9d27ad49d6fbc26f1f51e0c3f7265d6f0379565668ceef8078a2445b4f94618bb645f43613a0e81ef39ab8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764382, "uuid": "e0a1fa7c-da3f-4992-95cd-5d9d1fc4e4b4", "value": "T16AD4016533DCAB53CC3E5BF60D32D1D113B224162150E62EADCA26CE2932B155B66BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764382, "uuid": "77024844-cd34-4087-afdd-7e2383f2c502", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764382, "uuid": "a680a983-ed02-4113-9956-55b671867cee", "value": "12288:ntD000Lc94DYqwg/X7RD3fF1p8sbE42cEser3bVGZgKVg8nJQUXz4RSMUTD:nC0v94Xwg/B+s44XEsePVGgKVgCNURS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764382, "uuid": "c4c9ed94-780a-4a89-be0b-8421fe279685", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764382, "uuid": "747858fc-93bf-427c-a68d-72ab5f5b8f33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764382, "uuid": "2cef774d-5def-419c-bf68-7d39472d5d66", "value": "RFQ-110146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fd44bf-4d62-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637784795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784795, "uuid": "1ee032a3-74f9-4e8f-8fb6-8041d29f754d", "comment": "Malware payload", "value": "d0e4e9f28ea09dc47d53cd9da0bfde22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784795, "uuid": "c54458b9-1830-44c5-b616-830b2f001fa3", "comment": "Malware payload", "value": "3e1bc313ff31d0fc14887101ce4d37e9bdaf7c3b1f4a3687a9b2fcc792fa7548", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784795, "uuid": "fed29b09-b358-45ff-bd12-fd9a66ee6658", "comment": "Malware payload", "value": "d57d1cb3828a2d58fb0dcef70792c4df8af47536", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784795, "uuid": "3a44094b-d6cd-4cc4-b2d1-6c3c9951fab5", "comment": "Malware payload", "value": "eb6ee3377c46e8c1629eb4503225d27ec90fb34ddc05ffddf687f137d4a6b624fb94e956b0044cb5e62bacea9fd6b14e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784795, "uuid": "c6a9af73-d8b6-41bd-9012-4cff0e37b902", "value": "T198B4F1243A63D9A2E4A4277BC9CE51840370B9057A83D72F7C9D332D6D167E36B10ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784795, "uuid": "6a988ad2-c1d1-4008-aedc-806657902d5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784795, "uuid": "013c9542-e8d3-4dd9-9f07-ee0ecf76573e", "value": "12288:NmsrrvGriCsxSFUixa7Opt1Kn40EcaNcVwS/h8Y7d:MNDUOt1aP3fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784795, "uuid": "bced9b80-459e-4fa4-82c4-17ecbd6c0cf1", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784795, "uuid": "91643064-a43c-466c-b76e-b28f730a3879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784795, "uuid": "00fba5af-5476-4b5b-a808-109636a1273d", "value": "d0e4e9f28ea09dc47d53cd9da0bfde22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cf439e-4d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637794869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637794869, "uuid": "1073b406-2ba7-4ef7-a9b0-d848b7ec3520", "comment": "Malware payload (RedLineStealer)", "value": "86d43ae6596a50ac4bf5660712dd46ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637794869, "uuid": "b6f5d775-9084-4bc1-827b-d475d0b66399", "comment": "Malware payload (RedLineStealer)", "value": "3e8869030b9c89b8c43e9f8a6730a516e3945ab1272e31502671943847dcde60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637794869, "uuid": "3d963ca7-3e7c-4ad2-859c-aa92bd26d395", "comment": "Malware payload (RedLineStealer)", "value": "51a04cd4ab84fe708cf79a52af11d6211211f2fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637794869, "uuid": "9210e8fc-4ce8-40ee-9b41-88455a115afc", "comment": "Malware payload (RedLineStealer)", "value": "58d1d1781a8ad586a58d324a260785337a56fc8ecec0d38cbdcdba7a36e7cd44bd16c30c3028ef6da447776801a62005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637794869, "uuid": "6620b80a-0735-418f-a32e-256976174a7a", "value": "T158363322AF915571E6326D33542A2941627ABE301FD89A4F9390967DCD73EC0E330F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637794869, "uuid": "0de2dd51-6648-4375-9919-8325ea6c6c2e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637794869, "uuid": "a7688428-c65f-43f2-8098-22392f94bcf9", "value": "98304:PbaDp9rTdiYuZWZ/xK7yLobM3LmhwxOjlWJzscojwosUIrNTlXnF/0pRYaRM7c+8:PyTdOZw/xtp3Shw2dcbosrRlXFc5eBGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637794869, "uuid": "c29d4526-14b3-468e-9a76-ad7aeb0644dd", "value": 5314436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637794869, "uuid": "3025cf1d-0b48-4ae3-962d-9a372caa8a51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637794869, "uuid": "6b7b1591-2d48-4c04-b9e5-32f62c135208", "value": "3E8869030B9C89B8C43E9F8A6730A516E3945AB1272E3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50528b1d-4cd9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637725678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637725678, "uuid": "c690dffe-8e11-42d8-82d7-07aa67f17208", "comment": "Malware payload", "value": "ced6d2270cb6c876f60d35ead4cdfa29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637725678, "uuid": "afa57a2b-c3db-46aa-aced-120c360642b1", "comment": "Malware payload", "value": "3f1f6a35b6f0c34c5efa441afe59a8c4580e7e5a641ad286770af907fbfe672a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637725678, "uuid": "5af63984-afb4-4299-b69c-d2860471b083", "comment": "Malware payload", "value": "f224e09020b678b1cf8713847476e71da426ca83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637725678, "uuid": "f31f4ede-7777-4e33-8590-198c1a631eb8", "comment": "Malware payload", "value": "0ecfcf6bcb9d535efa535d9ede8b15b8a68233e1158d0f7c76b7db1ea4c274e546eb8206dea9a0850c638c28d7017daf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637725678, "uuid": "b383c85e-d756-4f2f-aa9e-0047ab02a945", "value": "T12E463336FC03E1F2FE1552348AD6E1FA02D35C2AD3456C26EB1A39CB94B4ED69605B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637725678, "uuid": "b67f5a8f-f378-4ab0-895f-98c10f25990e", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637725678, "uuid": "f811f8e6-5028-4c0e-b2dc-701cf6db90ed", "value": "98304:SG1U4CtCWcaYy6ivkMkhPWXiK9EnnYTXEy4L1hXMls4GaiAeQQYMH8RxU8FOiN4:fU4V+Y1ive8SK9EnnYTELbw1GaoQsc1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637725678, "uuid": "254b9608-57ee-46cd-bed8-5582555e8f11", "value": 5808128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637725678, "uuid": "0049be2a-2d4a-4312-bdc1-d7a3d58a7d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637725678, "uuid": "bb968204-501b-48d8-b1cc-02d5d985c756", "value": "ced6d2270cb6c876f60d35ead4cdfa29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c130fb6-4d2b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637760916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760916, "uuid": "73f6f780-f43f-44c1-a3ce-29b393d05ff8", "comment": "Malware payload (RedLineStealer)", "value": "e31893ca0c91bd54e4135ded2446901b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760916, "uuid": "b3c3d2bd-ece4-4a9e-b64e-7db7bddf76a9", "comment": "Malware payload (RedLineStealer)", "value": "3fb74a3f94a3c50a794e299d9e2be36d86870570dcbc99df904d7fb0e1b650f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760916, "uuid": "1b7283bb-22fb-4d20-86e4-3fdcd93b5c81", "comment": "Malware payload (RedLineStealer)", "value": "72cec0c6e832925800de7f525571bb3fff246265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760916, "uuid": "2eb4f37c-7f1e-43ef-b2c4-f31f99416231", "comment": "Malware payload (RedLineStealer)", "value": "0c4697926dc4d5ab194e15b77eaf0b3e257865bc2320d7198faa5e89695aa17d3c8dba96316df41ccdee26aa8e5a4cce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760916, "uuid": "22e8222c-f6ba-4ca3-9e79-1e8a4c323ce0", "value": "T16755333B3EE6FF8CCD02A4F312EB9F1B562572404AE1156773069EC2601B1969B48F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760916, "uuid": "b4a1303e-a28a-453e-9e73-c603c228851a", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760916, "uuid": "1b38b083-58a0-4fa5-81a6-3d17d4bc7afb", "value": "24576:GNkcMyn41D6cmU0wCLzNk3tNBghnkEaHNYK3EQ3V/ofAW:GNC69NwCmrBynNaN3Rofx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637760916, "uuid": "028045fe-ab5d-44d6-86cf-2482c766c2ec", "value": 1359960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637760916, "uuid": "a5438049-4f31-438c-95f1-0cf1236657c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760916, "uuid": "b9bb80ba-0535-4076-ae50-cd02b104b1c8", "value": "e31893ca0c91bd54e4135ded2446901b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60601716-4d27-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637759205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759205, "uuid": "aec2a04d-cb84-40c0-aded-2101994194e9", "comment": "Malware payload (AgentTesla)", "value": "29386bfaa0e1e75059869608c7956a35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759205, "uuid": "a6115c25-701a-4cca-8395-1fe602c838c4", "comment": "Malware payload (AgentTesla)", "value": "408b57cea03846c98d77cc7e985eae5a087bac03ae4ff774d2250c7a9176cc9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759205, "uuid": "e284b33b-5b7f-4fa7-8d49-e4083b8af0a7", "comment": "Malware payload (AgentTesla)", "value": "878a8ecc037120d5edab9d836f7d87b06645f38f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759205, "uuid": "a1579136-3684-4c5b-8821-8dceeb13c102", "comment": "Malware payload (AgentTesla)", "value": "26e3a1831bfd0d466f29cb244946296cc1e6fc744c7c681f168169351c9b83800a1330dc9e8f1d0c26945fa5f9ee45c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759205, "uuid": "5b258491-2caa-43c6-836c-fb01a8207b36", "value": "T108A4CF1033FC0A2BE5BB0F3994B451006A35B9979E92D75F1A4470DE0896FC1AB3B76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759205, "uuid": "08060f46-8652-4d84-b6ce-60dc4c5e55a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759205, "uuid": "ef394614-b42e-44f1-92b5-9c5fa81f3ba0", "value": "6144:a2sZS+GMKayBsNS61jlpYLAW+E9s4AqZ2DAp3/m1MkK6:a2mKgNS61hpqYWWAB/m1MkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637759205, "uuid": "68fdf09d-6fb4-446f-ad5f-8814d6e4fc4a", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637759205, "uuid": "aa8d0f0d-2aa9-4b39-862c-4930a47ebc05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759205, "uuid": "6b7d8745-b974-4076-b54f-f41e43962879", "value": "amendment - LOI Letter + invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da308991-4d64-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637785609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637785609, "uuid": "848e7fd8-21ed-47ce-aaad-dde88e355f0e", "comment": "Malware payload (Formbook)", "value": "079787bc91a1990b5e57903253c822f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637785609, "uuid": "90e450fb-9aab-480c-adae-5732336d708f", "comment": "Malware payload (Formbook)", "value": "41469a749da51e8aa7e1ea159041bf74f712dd4f23f076188f547ee0c0f7933f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637785609, "uuid": "abef6cd7-ac7c-4724-9af7-518526fcff24", "comment": "Malware payload (Formbook)", "value": "c6fede48ee4b3839b12a46b1c1e72e602cc7748b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637785609, "uuid": "d99bce7f-ed91-4fd8-9ac6-66c891bc07e7", "comment": "Malware payload (Formbook)", "value": "cdcd444b23fd260bf48d1ebbbdfc4e095113ba60223592b355b40665ab7beafcfe513c87986071794a4732ed743307e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637785609, "uuid": "4090341a-82c8-4076-ac12-9756dd0a67b4", "value": "T11FF46B62E9C50873C0365A39DD4BEFFC86713E292D7EA80A9ED06E0C4F751916A235D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637785609, "uuid": "6b44891d-42a5-4407-ac2c-dd5a4a9485a4", "value": "eb3e9d8cf19100c077e1fdd127bcd369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637785609, "uuid": "a25231ca-684d-4538-809d-7661b2ad569e", "value": "12288:g6Hvy5le1KrvnEWkPpgiVymUqmCRb3seJ1B8ZDfwUCm0gRS+:g6PWleMvnEW0pgiJUUx3zJ1BM7cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637785609, "uuid": "6ae58143-400b-4131-9e68-ad54cfbcc85f", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637785609, "uuid": "1390dff5-4588-44fa-adb0-2d43a51729d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637785609, "uuid": "5af953ca-8672-4ada-b38f-5fb01e52d025", "value": "Racun je u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc77b033-4d3d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637768916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768916, "uuid": "4e88291b-5ec1-465c-97e4-6ffc8e60b2c0", "comment": "Malware payload (Loki)", "value": "823d7eb8c11702b4b45d9e9bfcfa682d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768916, "uuid": "7f96c2dd-9518-4432-a5a2-f11dc7079082", "comment": "Malware payload (Loki)", "value": "41ae32ed68efaddc6356bad1b122b05a07cfc63395f5dcfd59b978c5addf66bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768916, "uuid": "02e8fded-a483-4f7a-9e61-08d878b16b36", "comment": "Malware payload (Loki)", "value": "f08189403a2ee98dfd8c3f26f4fdf868bbaef4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768916, "uuid": "16be64f8-04d5-4b29-b113-3425ec905bf5", "comment": "Malware payload (Loki)", "value": "3c51d52cd70d13bf7e38371209fc9a1be23b4172c237aecb467a3a8a4aca2d0dc1824e56f0fc83278880ffb79defa6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768916, "uuid": "ecbc19d6-7e61-4123-a978-72ab24a8e29b", "value": "T11694011131E56767C87A4F761C242280137266513E06FF8FBCC9269E3E9AF9E4B12763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768916, "uuid": "51b9a7bb-7016-47e8-b459-ebae27d12667", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768916, "uuid": "4b9f2a62-e672-4bb5-b650-a146843c2c5b", "value": "12288:9si7C3cm0Cu8pM/KMccbgcU4zVZIihdpKrNl0beD5:917lUu8K/KMccb28VZXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768916, "uuid": "54e8fbf1-d09d-4acf-99f2-91adbdb07d12", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768916, "uuid": "f5439020-b91b-4d1a-bb7d-f3429f71828d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768916, "uuid": "fabd1be5-398f-4e5b-bb99-8ba34286e6d4", "value": "xdZEQ8UeBKNkpi2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856f5e3a-4d03-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637743806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743806, "uuid": "16b791fc-0630-46af-ace6-b2c722b54805", "comment": "Malware payload (Mirai)", "value": "0897e06755b0019a52c90752a2ca4ca4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743806, "uuid": "46159cf0-23cb-4cd9-b2b1-c8c2c343d0b2", "comment": "Malware payload (Mirai)", "value": "421ff10fecdcfd4e3b5ff657cbdb2173e0f79b37334c2d030f2c6871f9f88485", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743806, "uuid": "b1a7993c-7cbc-4255-ac4b-684de2aa8625", "comment": "Malware payload (Mirai)", "value": "ccb76d96a6c2fa739e69bc7887f1d1693a7dedc4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743806, "uuid": "2f76f078-b7a1-4f62-a244-8202aec077e8", "comment": "Malware payload (Mirai)", "value": "fb6b1f364593838055ee047425cb7def5f64b07919dffa2179f39637f17e9a2927ae370a3cbbeb523cb566d29905a35d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743806, "uuid": "f72cfc67-610e-42d3-8f71-b8fe3996603a", "value": "T1EDB32982FC42EA11C7C207B7FA6F118E331553A9E2EE3202DE155F6537CB84A0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743806, "uuid": "215fe4bc-1a1c-4061-ace3-7259255966c7", "value": "1536:Mh98CZM5DInLUi/IscXMI1E5SP8t46tR/NL6t8zZTQuLEiNiO8uvLi97TgzZa:Mh98I+DInA9Sc84OfLXl+i1jz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743806, "uuid": "bba69f4b-7b26-4a80-8382-4f55e5d9d666", "value": 116192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743806, "uuid": "e7a335ff-13b1-4641-9e8c-ccc8ed0cfe98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743806, "uuid": "077ff9ec-cccb-4076-875b-edd927fdf572", "value": "c0az1l4js3001lsk4xd9n.arm-20211124-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfe556b-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637782310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782310, "uuid": "625dfe48-5264-4edd-9935-f9686144f9f0", "comment": "Malware payload (AgentTesla)", "value": "1635d06fd4a5735f9bec38e7a747763c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782310, "uuid": "41b2a57f-1993-4f1a-8387-91090e2683b2", "comment": "Malware payload (AgentTesla)", "value": "431f96eef59f6171d225d24e49c431fba001cf8705432ccf72bed32d777b74c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782310, "uuid": "b01cb84b-107a-418b-9326-fe0f31188cde", "comment": "Malware payload (AgentTesla)", "value": "1dd88aa572cf6055c6e4f42ff61840f253a560d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782310, "uuid": "1eb5cf66-f9c2-418b-b7fa-b01911005ba4", "comment": "Malware payload (AgentTesla)", "value": "ddd62e5efa778a567282ddeba1e823090b75ac389a87b3090deda928e48b527798c914175adaabab6eb63fe79702cedd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782310, "uuid": "c9416c65-edae-4a12-bf4e-938c09f48fc3", "value": "T167D4CF983650B2DFC827CE768D649CA0A630757B570FC217A04722AD9D1DAABCF251F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782310, "uuid": "44ca718a-cb62-4a3a-9a36-8084635002bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782310, "uuid": "a8214413-e967-44b6-8ef0-c29ba5d83386", "value": "12288:SmY3XfiCKuudkdwDxKw9vsLEkMj/OTu52qtD00Kx6uexcnghSda+qzW61aUVF:+3Zdu2S39v8EkMi652qC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782310, "uuid": "45898336-2f72-41ca-a36c-cb6ae81d4a83", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782310, "uuid": "26ddd5d3-8bb3-4554-a692-cc5bc98b5064", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782310, "uuid": "040d69fb-e9a6-4eb7-840d-880fee5b0a4a", "value": "Payment Advice - United Overseas Bank Ltd(UOB).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9834ccdf-4cf6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637738254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738254, "uuid": "e10b7108-7ba0-4f9d-947d-67d0aa88d482", "comment": "Malware payload (AgentTesla)", "value": "7a0b214261eed3d4687f89d8a4d21fc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738254, "uuid": "1d6125fb-7d8f-4967-b529-8c093191d20b", "comment": "Malware payload (AgentTesla)", "value": "432c5e67b5daa62ae24aff8a5f246ceceb40380f07fc04031f0a43b774a7fc2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738254, "uuid": "62f4923d-d864-41c9-9ad7-0a9e8452882a", "comment": "Malware payload (AgentTesla)", "value": "4d3a5d83ce96832f45986bd473cff28a5e492ad8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738254, "uuid": "d6ba845f-3def-4c94-94e6-cd311093260a", "comment": "Malware payload (AgentTesla)", "value": "eb6da70d6286aa9e41a68d6fb405cfad2f8b50bfa7aea96c302fea919dde78cebbae6a4078d8fbb68f0494cc365f67ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738254, "uuid": "d353d6d7-8f26-4108-9601-936ca18bd344", "value": "T118C402213289A267C93B1F791C6225C0027371162D16EF9F7CC9178D3D9BBD98B12BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738254, "uuid": "85311839-3a7c-470d-a59e-2d5714fb12be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738254, "uuid": "eb8d58b8-85e6-4934-a3f4-fd12459911ed", "value": "12288:miTg62rF0aFcpZZYZvcCFDTZNoTtLzsvfSJaCKDH:260Fc7ZYZkUlNoT5svaJaCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637738254, "uuid": "646b0761-e50f-4ba5-a76f-c40906a1f9f7", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637738254, "uuid": "8b84b5ec-b0f6-4506-b67f-ab95dd9be335", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738254, "uuid": "1195ba3a-db4f-45ba-b038-45147cb9fd8a", "value": "Freight Charges.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c13f7e-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764697, "uuid": "f8c1f34f-78cd-4dbf-87a5-7b84aff7036f", "comment": "Malware payload (Dridex)", "value": "04007a0e50f3836a555f63df98dffea0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764697, "uuid": "403ea792-458c-4c24-b42d-d5279103b0d7", "comment": "Malware payload (Dridex)", "value": "43a98442d5650bdfc9e354d1bcf39dd3e65023be25dfaf0fc7f302f16f31a69e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764697, "uuid": "f7028517-1151-48fb-b631-23474ac2644a", "comment": "Malware payload (Dridex)", "value": "a7a571756fd9f932fcb8f672c1b27badb1a51d6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764697, "uuid": "7fc2c5e7-2642-448e-bac1-234327c73135", "comment": "Malware payload (Dridex)", "value": "e74eebee5c7061bd3874bc6046849bd8d7d5cd9efe4c5b906b9a6e627b375f341d8f66b1cc6b3389f9e24f4613ba795d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764697, "uuid": "56022a00-eeca-4212-9f47-de4929936cb0", "value": "T19F73029DC4DE7054CD6EA8BDA05A0DD5B505448BBA96804F3C646E9848B238FFF9F037", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764697, "uuid": "6b2eadc2-add5-48c1-b9c4-95902c3df606", "value": "1536:UWNPFwJpvc1e+BwT8YIbDMz+1d6xBW1j40oPQBXg3Fc5rd7vu1Mgd1Qu:VCMrbDu+1d6xwl4BPQgShvuCgdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764697, "uuid": "a1acded5-10a5-46b3-b8a9-fdf3561a3ada", "value": 78211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764697, "uuid": "19ec3dab-e819-4fa4-ac39-470c98c9679e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764697, "uuid": "e07ef6f9-e49e-4f62-af0b-8f606f491c19", "value": "salecoupon05894.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d91ff68-4d27-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637759201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759201, "uuid": "6766870a-f945-4b55-865c-378059388725", "comment": "Malware payload (Mirai)", "value": "0606626deb565e144bf3ed46d4a4b0a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759201, "uuid": "1c6b5bf6-d83f-4ab5-81dc-bf53229bd78b", "comment": "Malware payload (Mirai)", "value": "4419797ba433e9631546c672fca239fb44e832aecfded0a5b7a0dba6691928f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759201, "uuid": "0e7c8505-0298-4d78-954c-fec20a9988b7", "comment": "Malware payload (Mirai)", "value": "390bc2dfb76dbdbfbaddbdbfbcac68aba1cdc3fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759201, "uuid": "081cd216-05d1-4a6b-8b8d-7a12d50eb35d", "comment": "Malware payload (Mirai)", "value": "dc84463d42e20aaaef6971e0242861d284c4e24be75857fd672fd7db626654381cf047533cd61183d9546857f1b0667f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759201, "uuid": "5b3b1043-3c37-49f5-be63-87408e92b996", "value": "T161E3E70BBF610FF7E89FDC3745EA1B06189C591622A87B757630D828B64B24F19D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759201, "uuid": "e35e77e5-c839-4613-9a90-5ed3879d4f22", "value": "1536:xXsTFCtQWVm5wy59SrEmd4jW0S6vimCFeoKl2LxvYSbMS5PgHrWL3TghHvJZROjU:SFaQWVm5b590WjW0S4Rluj7HghHvJxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637759201, "uuid": "0901fb5c-04e8-4b89-95df-5262d5a855bd", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637759201, "uuid": "b5c1cccd-4d59-4806-9e22-d05ae6459052", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759201, "uuid": "457be975-f895-4f3d-bfac-a394dd2e4c82", "value": "0606626deb565e144bf3ed46d4a4b0a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff30d15e-4cbf-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637714804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637714804, "uuid": "b866b92a-7339-4406-8cf7-09a84b38ff28", "comment": "Malware payload (NanoCore)", "value": "c7ac272d4cfd98c9d86bff3b6c3e89d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637714804, "uuid": "a6d474db-4636-44a6-bec5-c7705c5326d1", "comment": "Malware payload (NanoCore)", "value": "443c27b78b0fa24ae1131834d0307fa6da57f1463695fc6480d0d3874d5dcf64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637714804, "uuid": "33c75fc9-04cd-45b6-bf70-9f0a5054279c", "comment": "Malware payload (NanoCore)", "value": "a6334818159cc0bad0a8ba8cc8204685bf5ba7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637714804, "uuid": "b8d21785-46b5-40e0-bfc3-2ee473001864", "comment": "Malware payload (NanoCore)", "value": "2e2ee6fe7d65a6562a9b3e5e3d6b59af2bffe87e0cc64ad783019e9a57f5d00170ab90a1bca2945c9eae2ba5fdb68552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637714804, "uuid": "892c0b3c-e474-409c-9a48-4e679a325aec", "value": "T1B19401A032E2A367C8BA8BF41D3545842733B6452B15D6BCACC912DF6E71F1387527A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637714804, "uuid": "b62d9e8e-d2a1-4a72-907c-5af3e2589bfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637714804, "uuid": "58b0572a-2f9e-47aa-8533-a4fb4666963c", "value": "6144:zLkLojuk0QX5ni5pF/+fucpLL2Iu6va9Lzpqwayp503UAd0xqOMpBFxQS/f7mkdY:zALo5pGpZ+HLL2P68LoaDw0xdMYK6vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637714804, "uuid": "08ae9a83-8fe1-41de-bd00-3cf676702188", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637714804, "uuid": "d0da3bf6-e0f4-44a2-8def-abd6a0862162", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637714804, "uuid": "105a2d32-ec25-4454-ac6d-c6944d8e6f1e", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581bb7d5-4d3e-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637769070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769070, "uuid": "a3e1cc41-4d1e-4b30-bdb2-2e0114806b96", "comment": "Malware payload (Dridex)", "value": "47ee46b3521d1f85743ab56ac8c4f4b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769070, "uuid": "0a174e90-37b5-44ec-b05f-c1a2174114c0", "comment": "Malware payload (Dridex)", "value": "444a0953b513aaad678d37e960dd7fe5841025e0bebf2e71eb350d4709a0f34f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769070, "uuid": "f1311a95-bbd2-4f53-a2d1-29c1cc1ecc18", "comment": "Malware payload (Dridex)", "value": "a4b5e087009458f9a6a0e6f7b2e8ebbb261233f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769070, "uuid": "ada59e64-c69b-47ad-8be5-d5c30f12a481", "comment": "Malware payload (Dridex)", "value": "99a529c2960ab43b5d8504721000dbe6ec25a5501993cf4dd9d0654b5f733b2d9e3ac67c24046af7847ceb2a6a34b289", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769070, "uuid": "4ea8f532-41b4-4452-aa4e-6a339f9314e5", "value": "T1ED63F1E8C16B644CCD26B13EE12F0EF9B4665842A686C3AF28CCFF54162561F1F4E536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769070, "uuid": "3eaa5cd0-a4ba-4886-8f27-01718a408c88", "value": "1536:UW9PFwJpvc1e+BwT8YIbDMz+1d6xUBiNNQrU8Qh8Y42pW9SEPKgdi:VyMrbDu+1d6xUB+N18YLpWzigdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637769070, "uuid": "3d63fe91-303b-43bf-8a6d-4d34624643d8", "value": 70272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637769070, "uuid": "a44e6847-0174-4e6c-9866-99f333b38c08", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769070, "uuid": "f8749c08-453d-4dfc-b8ac-2b6918c05d5f", "value": "subscription-673890410.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d3b44a-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637778916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778916, "uuid": "7bb5f7eb-3ceb-4074-9fd2-34e1b3fa49d2", "comment": "Malware payload (Vjw0rm)", "value": "c02d9224866714263a86c7e0d171eb5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778916, "uuid": "959bbf23-90fc-4127-bd0a-e23ecb79f1c8", "comment": "Malware payload (Vjw0rm)", "value": "446b8a7d95cd9c2d29579ced0cab2aca9556e0bceab4385888e8a5e1432127e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778916, "uuid": "dc2cd5b0-60a6-4f93-93c8-0978ca4da87d", "comment": "Malware payload (Vjw0rm)", "value": "2576662a369b23bc225a34299ac4134fd48ddb80", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778916, "uuid": "795884d8-a832-4429-856e-cbb46d71ee1f", "comment": "Malware payload (Vjw0rm)", "value": "14dd596a4ca80abd6d03a662a0abf8767183fe8ed56ac05d2617725c2da510616953cae4b003a5bcf81d7150a48ac4a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778916, "uuid": "427c5214-4210-490a-b52b-7570a80b58eb", "value": "T113C3C6FCF1011F22D252611C89DA092873B2E761F5EACF45266C7A09C1DE82F57CAED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778916, "uuid": "87cc3249-0b36-4a51-ab5b-1efc96197fa3", "value": "384:Yht/NXDw6y+1RbWWZKVoJEwFuQIoJ/jmCoJPhGa:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778916, "uuid": "0838adb4-ceb4-42a7-ac4e-163bc3ec1adc", "value": 122306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778916, "uuid": "be2f697b-fda3-4ce0-baeb-fa74148572c6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778916, "uuid": "a3313fe7-8638-4444-87f0-320d6db37c0a", "value": "ORDER-78965.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d5a60f-4d24-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637758141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758141, "uuid": "1ab1192c-8aa2-4f05-bbb0-2fa0bca59bad", "comment": "Malware payload", "value": "34e36e0ee955fd00259bce2870120621", "object_relation": "md5", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758141, "uuid": "584b42e2-eca7-4641-abc5-7cee2019de90", "comment": "Malware payload", "value": "44c7821b615328b686a815ee90cfa3ec292b0a88edd52b57eac21bdebf687c33", "object_relation": "sha256", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758141, "uuid": "f114383c-8cf5-4d69-8100-ae58bffc842e", "comment": "Malware payload", "value": "dbdd94dbe8db79ea6d7e9ecf3ef34e6f531bdafb", "object_relation": "sha1", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758141, "uuid": "3ffafef8-0e71-45d6-8637-ab245e7c4ce9", "comment": "Malware payload", "value": "6a1c1899b077305a761345133b298ffe5d46aad50effe8c598f9bebfe51ee5653acea9b9a534b1b981c688d4a490107a", "object_relation": "sha3-384", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758141, "uuid": "67d2b6ab-cba1-45ce-9164-190d16a44697", "value": "T1401423C8C6D132EE54B02229EFD3BB3174B4F73598BE31D1260E4A472095AC0696CA5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758141, "uuid": "15b8e730-14ce-48bd-ba49-94dc8344c0d9", "value": "3072:4UsWxw3CsYkUaMfI24KJ3zZ0OeN/qjSki3g8YJMvmV4EQre0vOq8c23ZBYuDAbqV:4PWC5FUaMfIeZ0tN/q+ki3MrUOhM+SqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758141, "uuid": "6c0a54a1-9dfe-4903-b424-52edc0c893b5", "value": 195080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758141, "uuid": "687763ba-4337-479f-b8e3-846ed69d2422", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758141, "uuid": "02a869c2-0530-4045-b439-b498456943df", "value": "nullaminus-6567725.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222859c0-4d13-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637750511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750511, "uuid": "6fb02bf3-6454-4b0f-8f64-f03476e3d7db", "comment": "Malware payload", "value": "ea7116ede252d7c9047ffe141990ce20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750511, "uuid": "b54872bf-4f6b-440b-a191-c94bc8f53163", "comment": "Malware payload", "value": "452f57e00694eb56c29b6d4d39d5484a520fbd3a56729affa9e20626dfcd891a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750511, "uuid": "b0a41c1a-7f25-47d9-a75f-29652cd5b059", "comment": "Malware payload", "value": "877167234aac12c59304ce6b349547d61d6d0965", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750511, "uuid": "c276cfc4-7be0-4651-a8fc-0835671482a5", "comment": "Malware payload", "value": "219b4f8d825cc8009c81c34bc34ad6081fa7d1a63658a65d184aa847c364a50491e2af951fa68479a6d3a8ad56fbd43f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750511, "uuid": "743922fb-4c97-470f-a658-284020aa75b4", "value": "T1B2D33900B5D99135E4BB427340A6A613077EBD26DF664EDF6BDC0C895B784C0AB39B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750511, "uuid": "c9acb3eb-1d86-45f3-9f4e-ce9e4e2fecc3", "value": "dfb958aba269022ca6c1b1dc661dc857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750511, "uuid": "de4c2a3b-8261-4d57-9473-91225adee393", "value": "1536:/p6HcuU9/R1su0f5c6Ohwfvg57VlnRxG6DzcCNczT8edwm7krGISht+RIO1neX20:RFuU9/R+RPZ457VzcuzcCEQ3//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750511, "uuid": "ab1f1c7a-7535-4160-a335-1785b8586673", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750511, "uuid": "ee140121-5b15-4b4f-a863-cd3e564eb5ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750511, "uuid": "fc6e1faf-dd6e-4116-8b04-8c39c3d42da3", "value": "SecuriteInfo.com.Variant.Zusy.407187.9179.3028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c6f4d9-4d5e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637783078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783078, "uuid": "40156d35-8832-46f5-af48-4826debdc9a9", "comment": "Malware payload", "value": "c03f75f276a4723370d6c6d6615c5125", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783078, "uuid": "6d93aef4-f7fc-4d8c-9efb-03de13b7eb58", "comment": "Malware payload", "value": "465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783078, "uuid": "60b1433b-bfa7-4c7a-8d0e-565cfa4dc5aa", "comment": "Malware payload", "value": "ef13b532ced32acf7318f1143883a7df63725971", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783078, "uuid": "0fdad775-94bf-4af0-8992-a889b4b73b5a", "comment": "Malware payload", "value": "2d12e3eda52a92965db9cc22bfa110017e268bd726b884c4470e2b832b71d88f61de8e7ff32dcaf53378c871d5370b05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783078, "uuid": "dab89a38-831e-4264-9b35-988bb2e83bcc", "value": "T140E48E22F2908477D1736A3C9C1F52995829BF103E29B94B3BE81E4C9F397917D292D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783078, "uuid": "19b25164-37f9-42a5-ad26-cbcf6a7d6a33", "value": "24fe7ddb81105d98c91c163e135557c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783078, "uuid": "3409b4aa-7332-4b63-97f8-d2b220bfd5b8", "value": "12288:T3jOn2k7T+CMPW5AAX4tbAYRrYJAeZ1sugXKyAt8wGpB5NPuvubQdGUGDFF+:T3i2Q+C8W5AqYDrYhi3KyAt8wJvmQ8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637783078, "uuid": "3f0603d8-d41a-4120-bb88-4b68ad1646bf", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637783078, "uuid": "029905f7-2118-49b5-a49a-42b58520223e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783078, "uuid": "7f86b123-7095-41b3-9187-5f65e6e5a5c6", "value": "c03f75f276a4723370d6c6d6615c5125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e95f85-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774517, "uuid": "f3132781-b326-4f8b-bb05-2a9385a4b4c5", "comment": "Malware payload (SnakeKeylogger)", "value": "18ceb91dd889d45b382fabe3c2be9289", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774517, "uuid": "27c5066a-031d-49ef-83a9-ffd0ae5037b4", "comment": "Malware payload (SnakeKeylogger)", "value": "46c635757927550c021a9953105fd0c3f5609722471c8a3cea5ca9291ac057c2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774517, "uuid": "26624bda-911a-4f55-8301-c94653cac45e", "comment": "Malware payload (SnakeKeylogger)", "value": "5b9b49fa2e8de5b0da39042e8b8bed79433099eb", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774517, "uuid": "43ab132c-c9cb-413f-b97b-055eded5e91c", "comment": "Malware payload (SnakeKeylogger)", "value": "58784d4d9dc7626494f40405c93cd9434ea4f2cf0837882c15782b6990e79058d3bb12c9227b67719249ce4fd435a0cc", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774517, "uuid": "0e71047e-ec26-41c9-968c-ecd64b8b55fe", "value": "T1FEA312A5366A767FF28F8D388415330FEB9109459D16ACA60EA9F14F785C9E30302E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774517, "uuid": "ca63b99e-c239-46e9-9084-e1514847473c", "value": "3072:lvOKZu86S3Roy9uFwZlsaFPOHYonHBxqPZQG:lmYuS/IwZltFPgYonHBxqPZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774517, "uuid": "959e8ff2-19b1-4fa3-8daf-49e27d13b720", "value": 105339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774517, "uuid": "be381726-fbbc-4940-8842-309f4d0c9dd4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774517, "uuid": "e308e88d-e191-434f-a48a-0dd7c148e95b", "value": "CSOIYQRONAGPERVB.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2c5556-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637776081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776081, "uuid": "264a50a6-36f0-4ed3-8980-d9aa3be73c0b", "comment": "Malware payload (Formbook)", "value": "0193aca82acbba4004353cc61a526cfd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776081, "uuid": "7597bcd2-6aec-4576-9885-cc55fc7cb9a8", "comment": "Malware payload (Formbook)", "value": "46fc6bd623a690f8b431b110bf5a0a1e030897c6d0f8945a9fb31e407a542d1f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776081, "uuid": "302b1633-eb2e-49e6-803b-b3487a58dc0b", "comment": "Malware payload (Formbook)", "value": "27b9f7396ac1ac67e5215b6e046e070eceb13313", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776081, "uuid": "107ef392-ee64-45c8-86dd-ad67c51f7f88", "comment": "Malware payload (Formbook)", "value": "9b890fb8f3b95ff7a6bea8109152b9bfde7c8d9e716ffccd2ee672c4ce02ab78876802f3e7ad87e8c99bc51d949a198a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776081, "uuid": "6c98ef50-65c9-451b-8996-9e115ecd7906", "value": "T1BF34121CFE81682AE0A23B732BC5E4C172E1DD668996449C7C3C317F87BD68F0561E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776081, "uuid": "9bf1591e-c98b-434a-abd3-1230fb3abc59", "value": "6144:hd2OtqT+xNcyFfqLhhNmUWgvJ+rs11LCz2Zrhzn:hd6VsyHNmUWM+f6R5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776081, "uuid": "dd62c4ae-f9e5-4967-b55b-8aa2aa5668e7", "value": 234392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776081, "uuid": "79b431ed-538f-45cf-a8a6-9add07b97184", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776081, "uuid": "a8d47aad-82c7-43fa-8708-d856b2841420", "value": "PROFORMA INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e810d09a-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637736670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736670, "uuid": "9c0934eb-14e3-46f0-8033-f3261d3f6e38", "comment": "Malware payload (Loki)", "value": "8f3e6645d5a65a2272add11923363e54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736670, "uuid": "377b6e3d-c80b-4307-947a-5459eac84548", "comment": "Malware payload (Loki)", "value": "471d3393c10a133edc55eac05110a9e3abfce9fa65f063ea6b196d5e01ba1e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736670, "uuid": "7a48fc49-6843-4fc4-9f29-a01f5e65ca57", "comment": "Malware payload (Loki)", "value": "278ea8eeb59ace5fb4178d7434b7bedf9d161dbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736670, "uuid": "adcf0434-5106-4dcc-a8b0-11c12f966689", "comment": "Malware payload (Loki)", "value": "4826eb0b6bc43966e32e86ec9e2ca0414aa62b8585d64afec4cbfe66cea97178b276ec88315919204a5bd3a8a4474cd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736670, "uuid": "d2e290c2-e1db-4dfd-a245-54e668014b97", "value": "T1C994022032D5A263C9350F370C6021C12372BA463915DB9FADC9639F6E56F5A4B23BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736670, "uuid": "f93513dc-79c7-48b2-b1b8-1d6865a19794", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736670, "uuid": "84d3739e-dd30-4ddc-8637-43f2ac812821", "value": "12288:JJs/bVWnXO20Iak58rVdEcdupGr/eJmhztkz5IMtQe3:JJspWXF0R+coUbe0MzLtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736670, "uuid": "f353e6cf-8cc9-4d95-ae80-e5a69d415c5c", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736670, "uuid": "638fd505-94bf-4e49-a0a4-892fa8053f9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736670, "uuid": "a7174b70-755e-4e49-8494-b3233acb19ba", "value": "HalkbankEkstre20211124073809405251,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19960a1-4d32-11ec-843c-42010a9c0014", "comment": "Malware payload (Hive)", "timestamp": 1637764147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764147, "uuid": "9b8ec87a-3488-426f-b349-a9a69f87f622", "comment": "Malware payload (Hive)", "value": "177417be748814f6168171a42545f9dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v3", "colour": "#ED3C29", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764147, "uuid": "749cabf8-aa74-4871-913e-0c057e1c696e", "comment": "Malware payload (Hive)", "value": "47dbb2594cd5eb7015ef08b7fb803cd5adc1a1fbe4849dc847c0940f1ccace35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v3", "colour": "#ED3C29", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764147, "uuid": "01f70380-963d-45de-9e53-428e6f35abe0", "comment": "Malware payload (Hive)", "value": "9c8b988e66e0fe6f9dab69b1055e4ee200531094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v3", "colour": "#ED3C29", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764147, "uuid": "63df9fab-ea3a-43bb-903d-5844ea19d1c9", "comment": "Malware payload (Hive)", "value": "a554bc3325f8c341aa0f45cad685f857e2b6961b6e7fe99e4fdfea8bac4f9d2ae578648e028d85072b59d54c21414a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v3", "colour": "#ED3C29", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764147, "uuid": "276d4cb0-e439-441c-98ed-690c0fb24838", "value": "T1FEF53943F8A1A5E4C8AB92344D6156A4AE30349D2734B3F7176097BD2F32BE45FB6360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764147, "uuid": "3f1f29d5-742b-4e23-afb0-cad1ace1ee83", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764147, "uuid": "d9c2208f-59e5-4566-a572-82553504dc54", "value": "49152:EynbnX4Rsrb/TFvO90dL3BmAFd4A64nsfJUvelzON7j93aqSCD0BUCoQPr8bg11t:EyrAe2lS75Hw+i4JROD5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764147, "uuid": "b6730423-f9f1-4af7-aa7f-3ac8d9deb1c7", "value": 3576216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764147, "uuid": "59ec4ca7-225b-43cf-88e0-983f736cd36d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764147, "uuid": "362eee47-caab-40fe-9051-394abc30284c", "value": "serenb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97bd900-4d61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637784292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784292, "uuid": "886bbe73-b36e-4463-9b0b-6e5579a31c6f", "comment": "Malware payload", "value": "68fa03994ec48970ba4a5dc70f6a5d5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784292, "uuid": "981dcab8-9519-4c8f-afe7-a48bd2d50248", "comment": "Malware payload", "value": "484a15290f403c7d8c60f42aeac697886e59ca212fcf5aad8d14016eda0ea484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784292, "uuid": "5f5a8bef-c561-4f44-ae09-aa7ac91cd509", "comment": "Malware payload", "value": "55cd8594bfc9347dd1c321fcdcceba249167a186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784292, "uuid": "8056ffa6-dd44-4d86-b68c-258d555ce1f3", "comment": "Malware payload", "value": "1df3ad590f2306b8c7c889faee9a38c5fcf90d4db43e68cb9003b022cf025893c941a69b1d46a04fad340bce2bceae23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784292, "uuid": "00e7a5c3-724e-4945-b489-fadbafc04461", "value": "T129D402923398A796DCB91BF10832908113727E1B9964E71E6CC632CF2E367525713BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784292, "uuid": "6219458c-c3ac-4b76-8324-5db4e180fbbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784292, "uuid": "6967e796-a80e-489e-be98-de3f2627d69c", "value": "12288:XtD00jVTjWXkd2yMlPW6ssx2WvU3yGUKAjcJQ5bLlyGav8g9n0Ry1:XC0RTsLFFx2UUvUKAgIvmhnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784292, "uuid": "d9253195-ffa6-4db4-8d61-e5eea2928cbf", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784292, "uuid": "123b0110-5934-4f05-a485-e832e2eccaff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784292, "uuid": "2aef0163-94c6-4e67-9e71-6d1eb602a6dd", "value": "Waldo Orden de Compra -SA112421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa09982-4d20-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637756431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756431, "uuid": "32ef9f8f-0f70-4391-8293-1bd5c20a7325", "comment": "Malware payload (AgentTesla)", "value": "aeb629ccf31de483937845fe4710c917", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756431, "uuid": "188fde94-e79a-40ad-b660-34f0a8958b61", "comment": "Malware payload (AgentTesla)", "value": "4889378562b68b415ebb7bd2e66d6521b100b1e0d89523c5e5d24f3cc647ef47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756431, "uuid": "5f4684a0-1074-489f-9436-ee6e1c4f01c0", "comment": "Malware payload (AgentTesla)", "value": "61b5374d20c746c3a4a4644494067ee19e29b3f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756431, "uuid": "103d2b6d-c02a-4c90-b02a-33113dd63bc1", "comment": "Malware payload (AgentTesla)", "value": "bfa58f267dd36b36f6f937af2dab03f2c0d0cc30945b9e94a39b2bce1618d5854df03a5397b4d18136960c82878106f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756431, "uuid": "efc5e947-b54f-490b-b78f-47657e59eb3a", "value": "T1E9C4122031959A93C93A4F760D21768003B376696D01EF8F6CCD125E2DA7F998B237B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756431, "uuid": "1d1fb748-95de-4a14-8814-6533b0924de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756431, "uuid": "81590102-285c-4e6a-8353-298509a750d4", "value": "12288:LzfgJlPUp+zO/COxGwxWK36OqcNEp4VCfdElaunQ5RZVt8:LTgJ8COxGwxWWoc3VY+arpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756431, "uuid": "ddf5942c-b909-471b-81ed-5c80dcfed89f", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756431, "uuid": "af5a5e56-a063-4051-85d6-6194f723eca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756431, "uuid": "af39bcbe-e009-46c5-9e5f-60c9cb790fbb", "value": "GCMN0779443177765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50fe9fa-4d02-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637743510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743510, "uuid": "9ed9b932-eeda-435a-afe2-d412194a4d4f", "comment": "Malware payload (Formbook)", "value": "2c55c6cd7ab79faa4c518e71bd81ea93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743510, "uuid": "47ed1361-b025-4068-9601-a7bef0d2d69e", "comment": "Malware payload (Formbook)", "value": "48bfedd401aa3d6197c31f80ed6a77e589d6cbdc71d7a90e5b4b6add24f42041", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743510, "uuid": "fcb73d46-85f9-4360-be39-6f543c858aed", "comment": "Malware payload (Formbook)", "value": "2b99c06083632664b224ef7c21ebe8e08b4d33e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743510, "uuid": "e12d96cf-9499-4a45-9708-2d3d3927e536", "comment": "Malware payload (Formbook)", "value": "b25d468d92a59d84105ec2e92c52edabd750ebb2b2e6b8d3407e767323382bce22fafb166e19ede2474927aaea21ef22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743510, "uuid": "817bc2d5-2f45-43e9-a053-ef4fcd213d10", "value": "T1F9E4CE23317CE1E2F8AD3EF50A2053402AB26D521631E54BE88F7EC9E87775BC6116D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743510, "uuid": "fa21752f-c381-422f-bd5b-5c26ec6a1ea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743510, "uuid": "65746284-01f8-41ab-9992-9db34d02d2a5", "value": "12288:eCATj3aup9AB2GP7opBrAqQq8ljm35/0yOA:eXTDfpcvQlxESpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743510, "uuid": "01c5b604-d7c8-4dab-ba5a-741713f40829", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743510, "uuid": "20d7d903-cfff-4642-87d0-22ebafab3197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743510, "uuid": "fbbc8571-51e7-48b5-8b62-521fcf6e248d", "value": "2c55c6cd7ab79faa4c518e71bd81ea93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb79cad5-4d35-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637765452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765452, "uuid": "770b2076-a9ce-4ae5-9d53-31107ebdfe95", "comment": "Malware payload (RedLineStealer)", "value": "4d7c2d3a4c832fd0e40514a479dee98a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765452, "uuid": "6139a351-f567-4afb-ac25-084bec2da3d3", "comment": "Malware payload (RedLineStealer)", "value": "493a4ef927e3ddc66c2a95c85288d6eaab1a33a772b2b21dba847a6f709d5622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765452, "uuid": "1b3422d8-a11a-4f4a-853c-158c251b6cb6", "comment": "Malware payload (RedLineStealer)", "value": "67068f7ff7f5425f2770191988fae5717aa748cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765452, "uuid": "f7d8aedb-4b6f-4744-a7d8-b4acf2cde8c1", "comment": "Malware payload (RedLineStealer)", "value": "73961895e86c2a21ac13a9ca3f940275365cc2315310b15a26e556061f88c9122af798cb2f6fb0fbc9e6f763149adc28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765452, "uuid": "8bfe6669-04e7-40cc-8831-6d08234f71c4", "value": "T14CE3BE1072E0F071D1E3163165B0DAB02A7ABC326A75478B77AB126F1F707D07AA539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765452, "uuid": "8358f499-9cf2-4bdd-ba1c-20ad15fcb979", "value": "bf61ae69989d1072f08e18d6fa6b3469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765452, "uuid": "2844b2db-a776-4288-8aaf-ebfdbb3adc4c", "value": "3072:a+oemgaoSit+07o/4NuSiEBv2RDgXU92:j3aI+07o/8uJTgEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637765452, "uuid": "7b9d2bdd-2222-4a3a-a9ca-83b9a684e70b", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637765452, "uuid": "b1f42b81-f923-4e18-99dc-c333406dfbd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765452, "uuid": "3ea6f74a-e32e-4e3c-b01f-462a9f845e5f", "value": "4d7c2d3a4c832fd0e40514a479dee98a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361a7d4c-4cd1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637722198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722198, "uuid": "7fb7e086-d985-4050-b266-5d2a19f4c01a", "comment": "Malware payload (Mirai)", "value": "72a33f6d358ff5202b79aef80a434a66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722198, "uuid": "0556115b-a469-4224-b3d0-f9e757bc26aa", "comment": "Malware payload (Mirai)", "value": "4a1b4bfd8e237b80922400bb541e74c26ec377caec5f9748c9230f9b7977911a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722198, "uuid": "7e5a085c-fb3e-405d-998f-6c3899b52a36", "comment": "Malware payload (Mirai)", "value": "21f8622a343a4193be4f484fec36838d761135f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722198, "uuid": "8ec1cedb-d519-4742-a6cc-1822202eed0a", "comment": "Malware payload (Mirai)", "value": "d8f02f4b3e36f3b57966a9a2689c6c55f1d1a74b52cc73b150dbf17448b1a13ee5730c69b63ddc60d33e7b499635ad94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722198, "uuid": "6be4fdcf-c5b8-4573-8fe1-cb79142e32cb", "value": "T14B93810AAF610FF7E89FDC374AD92B0524DD551A21AD7B39B930D818F25A30E19E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722198, "uuid": "460f9942-9326-4a07-ad46-f1610e45abdf", "value": "1536:IlGYxrXy40OD3B9wHeR9P6sTJpp5U6Xhsb7We:mGYxrlD3BOZ6XB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637722198, "uuid": "3ee64501-c51e-40dd-b17c-a0c81253659e", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637722198, "uuid": "17f34ee0-608b-4017-bca8-cf7dcaef7f0b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722198, "uuid": "b285eec1-89fe-4124-b48c-76d2afd858d9", "value": "72a33f6d358ff5202b79aef80a434a66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ce0269-4d29-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637760295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760295, "uuid": "e4a81b49-d34f-447d-ad4e-409419ccca38", "comment": "Malware payload (Formbook)", "value": "e7c4bbbddf375ad7e071ab337f488101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760295, "uuid": "956709ca-43e7-4a9b-b421-6b9d4381e2fe", "comment": "Malware payload (Formbook)", "value": "4ace533157b96ff8c832cb31e81d6beb606e3fe4f63bae05b923b9d53946c100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760295, "uuid": "b6034db6-e0ec-4f85-978c-46ec501e1aeb", "comment": "Malware payload (Formbook)", "value": "418777f39fc1386262ed8acbb44e29c9acdf3ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760295, "uuid": "5c98e551-ae30-4352-ad17-fcf26719f7b4", "comment": "Malware payload (Formbook)", "value": "932736bc09a0c5580938671098fd52058c28b7fc18a7b8ae99faa61ec396a69ecb0f65ddcfe68f35b5da0c4efd384bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760295, "uuid": "95217bdd-5504-4186-a6ca-daa98de60381", "value": "T1A3D4DF8034E9C1C7F97FCEB21CAAB5A411B8B9EDE089A0CFF585775A50B2351490D67C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760295, "uuid": "3af296ad-249d-415b-858a-3ace69b40ab1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760295, "uuid": "96631e7b-6c99-4826-8bab-fc5a62121a24", "value": "12288:EF0BL1yG0lb+tnskgubo7z+9xCh06ghVOoD71lyAKp:aIJ1tsJjh06QOuxlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637760295, "uuid": "952b4081-5748-427e-a6e2-fd2ac8ae8e3e", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637760295, "uuid": "a58775d0-52d4-4a68-8836-d32359bd21f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760295, "uuid": "69ae8a19-1b0e-4f94-b310-6251644c1066", "value": "Citation-HEQ211025001T-EXPP v4,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6fd4c8-4cf9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637739574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739574, "uuid": "b70a12fd-934a-4460-84f2-f947777a4b04", "comment": "Malware payload (Formbook)", "value": "eeab5d28902fb4aff988c480067be6c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739574, "uuid": "3d6feb9e-e3c6-4b17-84a5-bd4019b0a2c6", "comment": "Malware payload (Formbook)", "value": "4adcae40731cb2729fc62542c0e6c48717d461fa0f203be15c0cfd39f8b4ffea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739574, "uuid": "1bd1b16d-1c32-4d3b-99d2-a602301a1994", "comment": "Malware payload (Formbook)", "value": "1b7e4910be82696337d911096c0433b088e4d5ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739574, "uuid": "08dc1b10-927c-448b-93fa-1500a9b59cf3", "comment": "Malware payload (Formbook)", "value": "f72f9abd162a4d4959c15ed8030fa2bfee1438e64ecf8155f4207a5d336f8f0d07b0734ef9faae2f95788e96dd3d70ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739574, "uuid": "5e607d91-4ee8-496a-b189-5c7b0447ea86", "value": "T17084012132F5A357C8BA5BF40C2464C413B265553A16D32DADDC61CF2EB2F178B22AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739574, "uuid": "bc4f4e52-d89e-4318-8694-d11fd073694b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739574, "uuid": "b49223f1-6de0-41ea-81a2-c545f2ff0f8e", "value": "6144:PBlouWiaRfpsxNN8aIzdXMrbWJhZdspsIX4AnN5vOa8W2o:PDouWiyfpsxozzdcrSQXHnr2Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637739574, "uuid": "5f90b7fe-7d6a-43d0-9741-025a5f89ea98", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637739574, "uuid": "1308b0ca-c52e-414a-bcc9-e39fb375a6ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739574, "uuid": "e05d2a50-915f-490a-b1f1-1eb4fa143915", "value": "Orde Approved #11024021#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a658701-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637782308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782308, "uuid": "c7bc0cdb-535f-44ea-9e32-58adb1281fd0", "comment": "Malware payload (NanoCore)", "value": "23a2d703d27e7be5248ea4498790681f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782308, "uuid": "b23abd6e-5810-444f-a0a5-3f7091dd8502", "comment": "Malware payload (NanoCore)", "value": "4ae669ec3635f90dc720819cc42be0a400c431076177f5ad0bfb4867785588cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782308, "uuid": "d58140c3-e11d-49f1-bec2-4b42144cbbc2", "comment": "Malware payload (NanoCore)", "value": "c8bf9a5ff9b1c53ccf51d575e3b6b31973fbf669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782308, "uuid": "543221d9-5e3d-46a1-936e-05d3bc111f34", "comment": "Malware payload (NanoCore)", "value": "0cbc7c6ae0c8fb277ac88cc810dee2789519748d570d61b52bfbfca4cf6a7dbe0e07f9444b3ae4568aa1a2494026309e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782308, "uuid": "b0683b1c-5248-4051-bc11-9a476dc31275", "value": "T169D4DF503D65902BC4657AF0082FB2D877356E84B911EE8F28487B9F297378B57C26B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782308, "uuid": "49b23cdb-fa24-4018-8090-cfaeecdb76aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782308, "uuid": "3ad561f4-53d5-4c78-be68-54cca7a9e7ed", "value": "12288:bWXN/LqM8Djpe7F035txKRUiMYRTAjxSwAS/r3q3WGXWe:9MIeG3geIR5ur3hGXWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782308, "uuid": "d0ae830f-60a0-4a7b-97f5-7b52ccd3132c", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782308, "uuid": "f8cc7733-0db1-44b4-b11a-b7e334cf803c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782308, "uuid": "6abe1069-80ed-433d-b7df-113bd420f493", "value": "TS~039873663-30987637393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a3d4b4-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637750012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750012, "uuid": "feb09208-8fd2-4a88-abc6-7776150644dc", "comment": "Malware payload", "value": "fba7cc775922ae308d1eb5153eca725d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750012, "uuid": "d72163eb-9b3c-48a0-a38f-833e63a9fa34", "comment": "Malware payload", "value": "4aed64b5688ee64e51c2435679040ab6c5212fbe1de15ad1efffb5c41a0083bb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750012, "uuid": "f704408b-1cff-4248-9fd8-4ae2d5e12638", "comment": "Malware payload", "value": "bb67664b018c0b9e135e5abc9fc7b0406a130202", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750012, "uuid": "758ff174-a2c0-4b73-ae4e-22cdf4defc50", "comment": "Malware payload", "value": "bf25a52c87e7255524947dfe0d973a7c5e9b74d3625454c2f3b417c41d5f2bd15cef345a9b02673deed0c02bfd287a4d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750012, "uuid": "62b6ea17-5e34-4a3e-a3df-de8398d59652", "value": "T18C3184C0B7C56A3ED9AF317A6B514EC572B0A5098705A22B7E4843F95F70B80E60B422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750012, "uuid": "2ecb6d4a-4b94-43ef-a9b8-d39a6d82fc40", "value": "48:GWSRtFCHL/B3DAYZo1Ype/M1DF5t9fR9rtKdKp:ytFKp3DBqnqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750012, "uuid": "4fb2b0ad-fabb-47a8-90f3-dda03de72980", "value": 1809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750012, "uuid": "b4fb2b89-98fa-4d3e-afd6-7ef9e3b0e705", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750012, "uuid": "0994e57f-772c-4fd6-9af8-4f5c15fcbf43", "value": "PO_No998032.jpg2.kextraction.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e763d928-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774464, "uuid": "b37f5165-52ec-4b4e-b0a7-8a60a4d0aeb6", "comment": "Malware payload (SnakeKeylogger)", "value": "38a05134f672b6b5cb46843777ce23b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774464, "uuid": "fdbb728e-0cca-4b91-bc20-df352d90133c", "comment": "Malware payload (SnakeKeylogger)", "value": "4b397c5fc0f5c119f064c550b55c3027eae7a266ffb648ccad4b1adcd4ef9f9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774464, "uuid": "00eac748-8576-4601-b87a-0d8d8fb285d3", "comment": "Malware payload (SnakeKeylogger)", "value": "c6374569327aadbc423208818638f9745215569a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774464, "uuid": "fbc5faa6-bbe8-4da4-8292-ed736418960a", "comment": "Malware payload (SnakeKeylogger)", "value": "c25f2f646bdfe7c0d7205a7d7fe572c29939cea9335a8f9487fee93d2999987ffec01d06d5c0e0409c2a48af9f3b922a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774464, "uuid": "ceb11907-8474-454a-b004-0597e5b61397", "value": "T13205221076D0E157CD311F76496570C063BB60069E16EB9F6DC4638E3EAAB890B62FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774464, "uuid": "5805d2b7-73ef-41dc-9859-1055c53b4e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774464, "uuid": "17283f95-a5f9-48c2-bf73-d808442801e3", "value": "24576:QQqk8xEKnDzujgLHt8OKYFxRSqxXtaaNj:QfEKnDajgbtRKYlSitDNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774464, "uuid": "520d6123-749a-4aa2-995e-ac280687bb09", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774464, "uuid": "08b4a9cc-6a93-46f8-b89d-e188b7c00f90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774464, "uuid": "1049b6d8-c7f4-4bfb-837f-f2c95eed641f", "value": "2324567oTju9VlPd34ZJT8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc2ff52-4d62-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637784404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784404, "uuid": "9cd89583-1a19-4162-a3ba-3268632927c9", "comment": "Malware payload", "value": "f7fa1459bfd27a546ffd1f2051779127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784404, "uuid": "7f9c9936-458a-43e3-85b4-086cd636832f", "comment": "Malware payload", "value": "4b4c466ee72c0d623339564402175b47d68189d129bc9c3e61d0a8a504265acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784404, "uuid": "3caf77fa-6195-485d-a24a-e97cfda325a4", "comment": "Malware payload", "value": "e3c98c75926dc5db9987185988b31bd094411914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784404, "uuid": "821a06d9-c669-43ff-987b-11802a012c60", "comment": "Malware payload", "value": "49af3e4e5d4bb50a434e65c9f18ca36616aa88d679be379c8bde7b2b92d172fc54c1882e70311ca9e594a67cc08df4fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784404, "uuid": "13b1e259-77b2-4b94-a946-e7ed3d0ccc15", "value": "T145048C341F7E1A86E46534B6EE4364B1E0B9D4A07E5F1363D710C43E54A32FA26EC7A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784404, "uuid": "c07f20b2-3c21-49ce-a4b3-e6dc38f407e9", "value": "07cd32fe06d43febfbbba5706c9ac01e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784404, "uuid": "1cfd34cc-d187-4297-bb32-f774a8761082", "value": "3072:otGBk6WpPlzB6q25jnY2zhA5HdLT0ampFZjcvlISL+toZyIiXWuQ/B2incY:8GBk6WpPlzB655jnYOi5HxT0DZIvlIS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784404, "uuid": "6b2fa1c3-779e-4da4-8260-b184080a1f9e", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784404, "uuid": "7e4a0921-2615-46c7-8887-af87437b4761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784404, "uuid": "1c919044-6e1d-4e9e-8030-51972e9983a0", "value": "f7fa1459bfd27a546ffd1f2051779127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a8be58-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637764816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764816, "uuid": "dd58cf4f-fcd8-48ad-a1c0-ce50f84396be", "comment": "Malware payload (Formbook)", "value": "1624595e2354ff7be9e7dc6def2ed69e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764816, "uuid": "ce2b6f97-4c35-4580-add8-a87ecb3d26ea", "comment": "Malware payload (Formbook)", "value": "4b50745e74fea6faa516b4d46b7c9fbe36fdae2301b76ec940635d033707a2c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764816, "uuid": "e1be5a07-a3f9-4aca-a252-63bdeb008d40", "comment": "Malware payload (Formbook)", "value": "1dcfaae594e3690d3fef5fd4de855d02e9cbb2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764816, "uuid": "1784e2de-c357-4027-b8cc-4cfa98532862", "comment": "Malware payload (Formbook)", "value": "ed198ce9bcfceb7138f9683e69de376f47e711636b0a339b0126fd7fd1bb37f7ee595a77adc61e38f5adc41ce76f8b42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764816, "uuid": "c4ba12c3-16fa-44b1-acc0-8c07d93a2e53", "value": "T1CE54220D7BC4C2B3FACD5F390DBB27B6FBFB82C54A1A17528B682F2564851425E0B452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764816, "uuid": "415a9ae4-53e3-4a64-9590-5989ef1bba26", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764816, "uuid": "35eabedf-013c-4eb0-9d0c-353e942bb4c0", "value": "6144:rGiIouWvjqebPleWFVGwN5QwB0ZmAFd+DnMAlym7a:fzuebPlDVGwNh3AFPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764816, "uuid": "3761b3d6-e6ce-4990-a627-bf6d1d22c9f0", "value": 305085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764816, "uuid": "4cd36faa-7255-4d0e-b938-e0bef659e24d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764816, "uuid": "10578287-387c-490f-9f75-37d1d28496cc", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c00ad3-4d5c-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637782196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782196, "uuid": "80677715-3e11-4b8a-8ea7-468421b0cc4c", "comment": "Malware payload (ArkeiStealer)", "value": "bc537995518482bdabf2ded784122008", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782196, "uuid": "8cb4902b-a24a-4def-b605-909c1873f04c", "comment": "Malware payload (ArkeiStealer)", "value": "4b89a371a43590541a86aed238ed00b935d1fb9a609d1e6b98a8a16444aa3711", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782196, "uuid": "707f9032-47c7-47e8-974c-ad6a06b34f49", "comment": "Malware payload (ArkeiStealer)", "value": "b412dc9fb1be560f560b64e1bf3303878d3d2edd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782196, "uuid": "879af86b-2f83-43d4-bc0b-e8cbe766fcd5", "comment": "Malware payload (ArkeiStealer)", "value": "1d55dd29056b3bd80af57694b269de08800a46788d13548b8ad891f21e10a5c1b72d4838b199470377ee58cb21f585a8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782196, "uuid": "3ed8c610-02b2-4e1f-8cb4-eb9c99add85d", "value": "T1F114DF2132E0C872D0A7597059F0C5B12E2ABD72277D414A37681BBE5EB33E14AB93D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782196, "uuid": "4f65e348-9784-431d-989d-d31039063547", "value": "c53a5a8e9ef3dbd0aff245de270c9709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782196, "uuid": "8853eda1-a7a7-4477-8408-9d22bdf5014b", "value": "3072:duroscppoynfD7qpQw7TnWWeUtg/fmJFN6Q/V1Qj7EOHKz22:d8oscppoynr7q95eUt0f21QP2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782196, "uuid": "e11b99e2-9f0c-4088-bf4f-c21c1d571534", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782196, "uuid": "1810e0e0-e26f-4756-ad25-55bbea50d985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782196, "uuid": "2caf9c00-fa47-4510-bee3-37941b1f8afc", "value": "bc537995518482bdabf2ded784122008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b11ad1-4d57-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637779932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779932, "uuid": "80635e90-fe03-4dbd-86bd-4a2ed507bb8d", "comment": "Malware payload", "value": "35357a041b14cb08b8e107770a9f9c18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779932, "uuid": "b6ad5513-d6b9-4fc5-ac34-472ddda58022", "comment": "Malware payload", "value": "4c6f60ba070864a86dceaa5785b1dceb395cbe4667b9c539bc0675411b4e16a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779932, "uuid": "7d27976a-f49f-46ba-9f14-7cfaecbf67ed", "comment": "Malware payload", "value": "8bea8efd0562114eb266a616a11189dee0d84431", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779932, "uuid": "ec01d207-6b5d-453e-9374-7bf4992005a5", "comment": "Malware payload", "value": "02621a934c00a75c0e72e224129c430b15477e20bc0fc6ea5dcee723527da232750a7829f50ae5ff4bad302d91c00081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779932, "uuid": "95fc0c1a-2f3b-4bd9-8987-a264cbf588aa", "value": "T120B4F1343F92DD62D5591A77C98E60040371AA11B693D72F78ED321D6A12BE37B01BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779932, "uuid": "89166c98-1f28-4af8-8952-1e1a8e8d2c58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779932, "uuid": "780aef33-4283-49f1-9674-68adc836008f", "value": "12288:bkCWT71nH33BIYxsMnkvtb1FW0iYuGhDGpBDta05d:UVBFxsMnWrW0B9FGpWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779932, "uuid": "1e07c9a7-d02e-403c-b6ce-857f560312d6", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779932, "uuid": "49e40391-97fb-4441-a359-2c6fa0485a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779932, "uuid": "4dde3006-26e8-4d15-b86c-936ae2c44983", "value": "35357a041b14cb08b8e107770a9f9c18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e14be8b-4d3f-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637769402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769402, "uuid": "dfa233d6-9138-47c4-b00d-4c5d844cb7ef", "comment": "Malware payload (Dridex)", "value": "a242a5c20fe4c05880d3da94c3e11e60", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769402, "uuid": "ba534f6c-e59c-4293-9fb4-0c001b37e646", "comment": "Malware payload (Dridex)", "value": "4c87d87e76d26faf07bdaa6d083ff78b638f31f21054e4acdcf24fdb1a9d5026", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769402, "uuid": "3e6207ab-93dd-4420-b6cb-794dd8259309", "comment": "Malware payload (Dridex)", "value": "764dea5768952a35e712e9d8c136082f0438c145", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769402, "uuid": "516709e4-c056-43f2-82a4-bf96d2449379", "comment": "Malware payload (Dridex)", "value": "801925129319e13ae8647a984851ab38c004f4eeb023b5056c4432e748a66fa3058d861825f400f2279a216bbf7b045b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769402, "uuid": "1c1dec5a-94e7-416e-96b9-f9255b1baf1c", "value": "T1A063F2269F4FB9E0D2B7017CC05C2EF2760B0B2D6C55F10B14E8F61899A47C7A7C6629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769402, "uuid": "bd14226f-3f88-46a8-8a7d-6ad8426ee78e", "value": "1536:UW3PqrE3gpMokPF58Ik4kosQFVvSuMH36w+/EIOrefTAU8/B7zgdO4:VaEwFkd58IXkOFVvMpKOifneBfgdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637769402, "uuid": "476ef437-f19c-4572-a9b9-e4e244fc219e", "value": 67958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637769402, "uuid": "465a7450-a59b-42ae-96e9-7535c5b209fe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769402, "uuid": "d20e0111-d532-4ffc-94a6-c6893ff6027b", "value": "vote number3210109.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf2d296-4d38-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637766608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766608, "uuid": "4b833911-be7d-4890-ae30-d0dd0289112a", "comment": "Malware payload (Formbook)", "value": "5fd3937cd37b1f8ffdf5949ba5d4d1c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766608, "uuid": "4add886e-37e7-44b8-8e9a-d4e79c031af2", "comment": "Malware payload (Formbook)", "value": "4d14c4ae70e6eb6442b90dbc4308d180f43308e38112903c6afd33adf3e04ec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766608, "uuid": "e430118d-3ec1-41df-b3ec-d4ceffeb446d", "comment": "Malware payload (Formbook)", "value": "2660bf12889d52eebcffb9ac48dc77cc2e833c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766608, "uuid": "c7e536a0-07d4-4df3-8dba-c0962b59d685", "comment": "Malware payload (Formbook)", "value": "767fefed78d1bd77672c40698a027ca4521d3e23722bb9fc856df8d72a7d880150d905dcd542e87785227d94c1807b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766608, "uuid": "a6c375af-d199-4478-985d-45ce8c7278d3", "value": "T144C40265339CA793DC764BF60C31C18413B379267A54D61EACCA32DE1E22B115B16AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766608, "uuid": "dc7e45af-e2a4-4706-a6a2-f9cb4c1efd50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766608, "uuid": "7eedc918-18ec-460c-9f8c-b0f94fe79a3e", "value": "12288:ytD00kAcS8RIZuK2TjU6/TDhHgfwcVwkqo9:yC0/cS8SEK2PJPhHQwcGPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637766608, "uuid": "233900ca-3442-4411-bcd3-de17f6d2352f", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637766608, "uuid": "fba3b5b8-26c1-4df2-bc18-5fdc7c4a4177", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766608, "uuid": "04b327f9-0953-4816-9265-c21bc2f0a403", "value": "FACTURA PENDENTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107a3c40-4d18-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637752629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637752629, "uuid": "00dc4fe6-b9e5-429c-9967-a79db0fef040", "comment": "Malware payload (Dridex)", "value": "94de794b3efbfe346ed133eb36744d6d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637752629, "uuid": "9cf23b65-0d5c-4af1-90f2-73fca54599ec", "comment": "Malware payload (Dridex)", "value": "4e74091dc4f0ccffb2dfd184aaeaa35d904e37149049ead57fa6c355833cebfc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637752629, "uuid": "beb96d88-2912-41cb-a1bc-19562af8ecaf", "comment": "Malware payload (Dridex)", "value": "6ef9c58e439b92766152ebaa0e2d95ffefab0622", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637752629, "uuid": "fecf6883-3f31-4d8c-8ce4-edd2e68e7788", "comment": "Malware payload (Dridex)", "value": "d3bb1c6110213735c98c0a6222b0e25f8a27ee12a9a09957d554fb18dd8e38e0e9e7f0ecebaa0b235e2e145583f10501", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637752629, "uuid": "eb379626-8b3d-4b85-b688-c0f4db11929c", "value": "T1B373021F9117F4F8C6330A7D858B0AF6350A9227A647FE873061A2585CDE3734F9699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637752629, "uuid": "58a620c2-ce6b-4fff-b97b-94a6de20a5a5", "value": "1536:UWgP2CET+S+agP7nA9u9DE23KpT4Y/DZ6dIJb1gleblFgd3/r3:VBT1k7TAyArZ6uJbScgdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637752629, "uuid": "2abca4be-6744-4618-bfeb-7cd2352b4ffb", "value": 74982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637752629, "uuid": "a6998cfa-d717-43ae-8047-4d1f7628310d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637752629, "uuid": "38540eb1-b8df-4a32-8e3f-2143bc252850", "value": "Rooms_requirement.3692.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05ea2ff-4cfc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637740898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740898, "uuid": "f72f3a3b-08a0-472d-9c33-092274ceebbf", "comment": "Malware payload", "value": "301754e63090d7705efb3695bad0ede7", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740898, "uuid": "2821c0ea-a78d-41f0-aa77-de0049842424", "comment": "Malware payload", "value": "4e7544132ad5dfed67753cc1202d4a371deb015f9a11fc2bf8efa7b63b22dc92", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740898, "uuid": "d1e7711e-70cd-4822-af54-c6aeacbc00f6", "comment": "Malware payload", "value": "feb900467407036b1714b2df2af9f9d27c8d50da", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740898, "uuid": "61eb55df-1294-4c73-ba0b-f2b658a1583b", "comment": "Malware payload", "value": "122f761415f83fe6cccc5b12667dc5c59e939b910a4d9bcccfb0ef7a5fc3ace00fb5eedd10879b3d04fc2dd6852404b4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740898, "uuid": "8f9c68e8-da60-48d2-a441-5e74f06c8d28", "value": "T1B32533C667D0D119F82EE63E5F072B50C0EEB152621D6EFBC67184211A8F209B1DD9EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740898, "uuid": "ff58f043-1c48-4b99-bc72-09889e6e0c7e", "value": "24576:d2CNivpZjYcK/v5F+9K9R3inOvbsJDjvT4DFqLnz0:d2CNiv81Xf8K9RTvAFjL44H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740898, "uuid": "7fbe80e4-4cbc-4416-8ee0-c15cb63771a7", "value": 973848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740898, "uuid": "e08105b7-17f6-4c15-8659-d6eb9fd8e418", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740898, "uuid": "566e3e88-16ea-494d-bee9-b95c04499ccd", "value": "expbox-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1c4d0f-4d13-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637750506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750506, "uuid": "bb2980e1-f5c9-486c-9b94-9cac5fa1358b", "comment": "Malware payload (RedLineStealer)", "value": "b238ddaa1f398511916243fb9afd605e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750506, "uuid": "4e001b81-c12a-4d11-9eda-87f3c248051e", "comment": "Malware payload (RedLineStealer)", "value": "4f9f3b1046f94294c17f16d58405748bcf92530b963e170cb7f33a65c1794563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750506, "uuid": "a0074b84-0b6f-443b-be58-4676facf8561", "comment": "Malware payload (RedLineStealer)", "value": "42e0f4fa54643fdb2b38868f5cdf5cc235431e7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750506, "uuid": "78192d04-50d7-4308-85df-396002aeb969", "comment": "Malware payload (RedLineStealer)", "value": "9ea03cd3fd0a8c4b5a36be26121fb7dd236e753752d1f3c965006c56374a762c1ff19898997ad65d881d24b4558aa9cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750506, "uuid": "40c23abf-e066-4605-bdb0-844fb4b485b4", "value": "T1F3A35C5837CC9A14E6FF0F706CB0111483F5F5A36412EB5F4DC564EA2E66B816A22AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750506, "uuid": "daaa36f9-aa73-405c-8b26-7a32fe169cf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750506, "uuid": "42439625-0530-4105-9491-6d1d0265ff6f", "value": "3072:NDaDD4w3sheP5yO38dqIaK8vDhxxU03eHI9vXGqV:24MsheP5yIKqlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750506, "uuid": "e42fcf2f-58c7-4da9-b331-25c43a0fcd68", "value": 106736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750506, "uuid": "4761f5fa-e2cf-4d1b-ac2a-e56bcf5f84b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750506, "uuid": "09c9e963-94b3-4108-a4d9-519b692102d6", "value": "SecuriteInfo.com.Trojan.PWS.Steam.21709.7831.20839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7988a251-4d6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637788024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788024, "uuid": "7d7fa947-d4de-4422-8b27-ec9540aa708d", "comment": "Malware payload (Mirai)", "value": "b76bf513e30cae4119b95d0d53ea82cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788024, "uuid": "ff4cf2ce-6bda-468b-a258-1b3a5665bf76", "comment": "Malware payload (Mirai)", "value": "50ade69bdbec99f89eced5cf9d127b7a085d749432b1650bf1c3a36c0542a405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788024, "uuid": "2c02fb59-142a-42d5-a4b8-9509ea765504", "comment": "Malware payload (Mirai)", "value": "155c5651dfa9a99d9a5e498920c1651f9e01b37b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788024, "uuid": "61293413-ac2d-4ba6-a0b0-f87a3c3a4688", "comment": "Malware payload (Mirai)", "value": "e8752a5238c35ff5cdd9e0dc9b602ef7338993a472ffc982586a2920604ad6939a21bb26c97da44a22187f73dda6f76f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788024, "uuid": "818a4a40-0b83-4c5a-847b-3de73acfdea0", "value": "T127731946B8818E15C5C813BFFA2E108E33166768E2DF72239D116F2077CA96F0E77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788024, "uuid": "9cad815a-cb67-4d54-b4dd-c890869a322f", "value": "1536:u9CnFvJ8hFgR8CujFxoG8TIQ2LUlwD8naAMyT1qpKDqmkCYDzXIOiCCMzTUmo:V8hA89/wTHOj8XjTUw2mk/CKTUmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637788024, "uuid": "299b4734-30b8-474f-ac24-0402cf2922b6", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637788024, "uuid": "4ca8cc56-fa99-4242-a84d-5103e7c419bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788024, "uuid": "0d5155e0-0043-4491-b44b-49ac6502b3b9", "value": "b76bf513e30cae4119b95d0d53ea82cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e913f1-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637763662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763662, "uuid": "44321f17-7380-4ea1-988d-03f1b8c279b2", "comment": "Malware payload (RedLineStealer)", "value": "2cb66de68b0c2bef920a468c3f6507db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763662, "uuid": "eadc0ddb-ea0e-4e0e-a308-3c3b762f88a4", "comment": "Malware payload (RedLineStealer)", "value": "51160ae1edfcf45c5e3e6e1bedc4a5bdcfc27d5e23cb08c511ecd43b816b4c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763662, "uuid": "afa262c1-88eb-4a02-89be-6c7265b25d59", "comment": "Malware payload (RedLineStealer)", "value": "ba72deff71830442fe9e759fd0fd71273219729f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763662, "uuid": "fdd8c614-3171-4450-b3a6-accecbc41cbc", "comment": "Malware payload (RedLineStealer)", "value": "72c4b2c52f500a5ed471ceafa10efc395472a9f1f8a7b619ce7f24eb2a1a04ec120c86566da203f661a2c91d7c50cd0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763662, "uuid": "43841730-f2b4-4be2-bf8c-5772b037d543", "value": "T107B4FE136DD8F718A0915D3782CF2F291B922DD6873295566B09FEF112A42022E3BF7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763662, "uuid": "41dc614f-2125-4917-abcb-f7db560b37ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763662, "uuid": "87c65ea0-cc67-43ad-9b81-7b14b561d8a3", "value": "6144:rIeBPLTdISlaZff8X8pL1P7teRDnXpLKKA8+xheaDSXNsjUij+6r4UMY:tBDBISllkLm7gKTmDS2jUHs0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763662, "uuid": "68e83c7e-4f36-45f5-b340-d0a0778f82c1", "value": 510872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763662, "uuid": "899c3ecd-537d-4b0e-a664-aa37066c6c3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763662, "uuid": "bde07e31-062e-4982-9309-75d0aa7eefe7", "value": "51160ae1edfcf45c5e3e6e1bedc4a5bdcfc27d5e23cb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11e0979-4d25-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637758589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758589, "uuid": "1744d324-62ba-4d7b-8c3e-bf9d2023422e", "comment": "Malware payload", "value": "24d980785a2ba7e4fea56474b1a273ba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758589, "uuid": "a1f94f01-1abd-416b-9a66-bb1d29773c9a", "comment": "Malware payload", "value": "5180c8118a42aacf86bae3bf413dea2eb3b0297da6f3e5dd316caae792871994", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758589, "uuid": "eacb5d56-cdf0-42b2-b452-57344ceae3ee", "comment": "Malware payload", "value": "587507fd715da5ec29f6198ce13a044585539ca0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758589, "uuid": "646d5754-9573-464d-a156-03678e36888e", "comment": "Malware payload", "value": "dbdd15d30afc44a9e558de0697bf20b29d66c02c3549d8d9152dfd256e9b56b48b747c454a335fe288f7b782e661b90f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758589, "uuid": "114eeda5-11e3-425d-acf6-bdc05e1b8dfb", "value": "T18194232B2B7BA6FD61623EF615F4D7B4014B9EB26C1D21B9103652E50BC6234C48FE1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758589, "uuid": "b8b8be62-c4b3-427c-a5ed-b98c1b5103a6", "value": "12288:5pRC3Z24gEC8aLi+QR88LZzr0JAprqpiZGC+Ikp:Up24gJHuR88LVvprCioCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758589, "uuid": "9c753196-2af7-4a29-8f2d-5177de81ddfe", "value": 427996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758589, "uuid": "58b4246e-f023-4edf-8285-bd32dd1e6e2d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758589, "uuid": "b58fa0f3-c1e4-4388-986a-4dbc2993db03", "value": "emotet_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5c253c-4d15-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637751385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751385, "uuid": "982b94c5-6233-42f8-946e-1d9b15d82fa7", "comment": "Malware payload (AgentTesla)", "value": "da1386690408cfb6c959828b67d152c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751385, "uuid": "559d7faa-209d-4616-a530-1fd67e4b6ab6", "comment": "Malware payload (AgentTesla)", "value": "52015dc6d889034bcc9b77bb1129fa554a2ea2803d1af7fbc649caa150adb973", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751385, "uuid": "7272bca2-e544-4347-8a81-d21ad874da1a", "comment": "Malware payload (AgentTesla)", "value": "9a1d8672d359aa86251be0adecf62ac097e51fcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751385, "uuid": "caefbb65-3438-4a07-801b-7ee1d16d8875", "comment": "Malware payload (AgentTesla)", "value": "ccf039c83045c2a997f9d27c1815e53752f1a9bd6dfa4ed4aa2930fd386e32ee254162b311ef4dde303d6486940187f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751385, "uuid": "59c78936-9174-49a9-9a6a-c08c879b8713", "value": "T146C4129133906167C87A4FB70830514012B3BE5A7E10E78FADC5365EBDBBB590722BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751385, "uuid": "5b432487-61ab-4437-bd11-e9bf072e48dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751385, "uuid": "19ff0f4e-ecb2-47a6-b646-45116a4ecf2e", "value": "12288:EZUd1CVbhDTvfsgFVI0wsDO3F4ZAg1wxsandY78/y1:ECHCVJ0ImF4ZAg1wx1Y78/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637751385, "uuid": "53d5067d-fca1-4042-b336-84013a886d58", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637751385, "uuid": "9bb1311b-ab0a-4cef-bded-1287155200ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751385, "uuid": "ddbc5a21-1c30-4254-8ae5-fcc21ff6c871", "value": "Bestellung -SA95648,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70d6884-4d57-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637779940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779940, "uuid": "6d50b9cc-5c28-47d3-8046-5b0976b76f26", "comment": "Malware payload (AveMariaRAT)", "value": "ca470fb20926dd0e0e7a473523c7b221", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779940, "uuid": "aad73217-7e0b-4955-901a-9553b71fe257", "comment": "Malware payload (AveMariaRAT)", "value": "52334bf3c6b951dd0c7c33e36023fd7f1f4c6529cbd1a423b8198cc8b9193010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779940, "uuid": "94686fc6-4815-496b-b67e-beed6a957978", "comment": "Malware payload (AveMariaRAT)", "value": "a5951cd131ca921fdf74111e8e81253351f8be39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779940, "uuid": "53a5c961-631a-4b7e-b95a-11a2afb1f1f1", "comment": "Malware payload (AveMariaRAT)", "value": "1f787ea72749e4f274b30bbedcef47c3dce60c05366e87ca9c1fca581f2985de1d1d192d94f11a4ae0948a9cb8de613a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779940, "uuid": "c4eeeedf-2c45-46b1-afd1-5f2a214a3e6c", "value": "T14EA4F0343E92DEA2D4681677C5DF50880331AA057A93E72F78DD335D4A02BA32F51ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779940, "uuid": "188558c0-1a9c-4481-b954-b56d606e321c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779940, "uuid": "a0927d23-6296-4f4b-957a-428330327110", "value": "12288:9/7XAp1BxIa/8n/q4N8YGRPJNTbR/JvFjmk:+V/8n/qBRBpPvFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779940, "uuid": "feb3ff86-a521-4136-8e32-123f0e77453e", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779940, "uuid": "df5a5fcf-58f0-4ca1-abde-b641c5ca1790", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779940, "uuid": "96a7acd5-58ea-488f-b1a1-8e3aa96d1dd4", "value": "ca470fb20926dd0e0e7a473523c7b221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11758916-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637749624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749624, "uuid": "5a0c4630-d30d-4fdb-bb65-3fed0d7dad41", "comment": "Malware payload (Formbook)", "value": "b2cc1c1567f777df80f025b659bebada", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749624, "uuid": "529aedd0-2d6f-44a0-98e3-7a7be456b1bd", "comment": "Malware payload (Formbook)", "value": "52d6bc00aeab275ccf88aec020031b5f7b40133c3112951c89ea871f124528b7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749624, "uuid": "6aa706ee-5779-4a20-9e3b-2356e3f08cfc", "comment": "Malware payload (Formbook)", "value": "3edded322035ab113b6828269c862aff9ffe746d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749624, "uuid": "791d8564-3a9f-4e7c-ba34-5fcdd7c1aa96", "comment": "Malware payload (Formbook)", "value": "1ae7c372bf68549dc889b1fe2163f5e3926ea1444bb6df7b84a0e1054eca76a5f6e178484a5790e39dee7ee51db3d908", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749624, "uuid": "8cf33065-eb5e-4106-9232-1c8590e29e42", "value": "T14B3412443AB7A398E4746DF8085410E56C3EDCC9FE579F07A6A4761C9F358772C881C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749624, "uuid": "b7eb697c-d1cb-46d1-a039-4e125a3046b1", "value": "6144:AqzA/EEwBcyfYNavmeDOIBj8QMhMZAEoQ1Y8W:Aqz0EEOYcmIBIQzK+1Y8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749624, "uuid": "50fc9c74-2b49-4841-b65a-dca1642a451a", "value": 234312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749624, "uuid": "305e7bff-a5f5-4f6d-a37e-28c2b0bd2acd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749624, "uuid": "69177461-60a0-44c0-8b56-d3d7a8a62132", "value": "1HT42224.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee20b701-4cdf-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637728519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637728519, "uuid": "f8232982-824b-456a-869f-64825bf04a7c", "comment": "Malware payload (RedLineStealer)", "value": "b22e5cba159668c1215ee232ad7a1ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637728519, "uuid": "23963e0b-c0a8-4c76-b9a7-a3cc2f7d55fa", "comment": "Malware payload (RedLineStealer)", "value": "532a8342b1bf55853765611228620df01679d25efd5495ec61877deb4ecb0363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637728519, "uuid": "35857ddd-3c8f-4993-a6d6-b81318a51db0", "comment": "Malware payload (RedLineStealer)", "value": "7b1dfdebfd83504c31167d6a96e1874ecbb0f261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637728519, "uuid": "0ea63e6c-0988-4c1b-a638-84651f305e33", "comment": "Malware payload (RedLineStealer)", "value": "42ad21c85c303a4962aa505141df3f35b4b9261dc0480008c1f315a607e0feda58b2be33a62795a0e940274ebd988e28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637728519, "uuid": "afa913ca-fe3e-4208-9b12-134eb48a485b", "value": "T15054F1D072615871DAA3AA30F870CE555A3F78E3A9B1840B37A8125D6FF0AD09A73357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637728519, "uuid": "c22b47bd-9182-4b76-9dd2-3c3e5119122e", "value": "a2592ff0cb9d4716be385a37eb0faa8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637728519, "uuid": "7fd61c58-ec7a-41b4-aa04-17861488aa9e", "value": "3072:UPrDzpka4RM/5Ti+6JM55253Zn5TBQls1n8fYjDH8KCdUU+OVp5JhpERfas2AqBq:8rDzpka4h+c5RIO1NCP+OH5JvEUGoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637728519, "uuid": "e65b2b0b-07b7-4474-b3f1-38d89d75cdcf", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637728519, "uuid": "56cb2791-8a32-4e34-b59c-d5fd7de71ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637728519, "uuid": "c53e94a8-9b60-4efe-8a9d-a406971fa6e8", "value": "SecuriteInfo.com.Variant.Fragtor.43959.21953.9488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6c84f4-4d4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637775793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775793, "uuid": "71f346b9-9642-41ef-a256-30f10a54c2fd", "comment": "Malware payload (Dridex)", "value": "65cbbb4aecdc222a7ee95b5030f74521", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775793, "uuid": "b00b4ef5-6a84-4954-b905-3ffc155e78c7", "comment": "Malware payload (Dridex)", "value": "535b30cabebf8c4002315f8f666c985597fa01bc6400bb4ac5f57d4e0df25dba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775793, "uuid": "fe8ade34-8e49-4949-8663-382feaec521c", "comment": "Malware payload (Dridex)", "value": "5ca48859415f19c3b50b3874823b2ed78c19a08c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775793, "uuid": "50a41569-0353-4d18-8e87-71721580c95e", "comment": "Malware payload (Dridex)", "value": "400b907b433ad19495a355723e3bc021286858fb8808791cb95f18dc4f1de23aa69082d9e7539001580ab8a796df8da0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775793, "uuid": "1975991c-fc10-4527-9388-53822afc37c7", "value": "T1E363F12FC719F891E3EB54BC80599AF0750B471C9EE4F30E38E8E1086C6179B53AD65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775793, "uuid": "feafc917-3233-4d13-9314-5427b0808a5a", "value": "1536:UW2PqrE3gpMokPF58Ik4kosQFVvSuMU0jKmBM92DOuSb4vMqgdX:VTEwFkd58IXkOFVvMUSKmXDOuXgdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775793, "uuid": "45b99bef-829a-43e2-ab2c-4563a79a2127", "value": 67453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775793, "uuid": "ab74bc24-a6de-4cdb-a7bf-808f8810a3cd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775793, "uuid": "1ba1ebac-8beb-45db-92a9-81fd75987742", "value": "salecode12610151.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cfa18b-4d33-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637764419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764419, "uuid": "4b23cdb2-3088-42e8-a783-face78be8466", "comment": "Malware payload (AgentTesla)", "value": "ff15bb989284670ac8fc3994ade57bda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764419, "uuid": "e093ed90-b968-4570-a60e-cc1185f58011", "comment": "Malware payload (AgentTesla)", "value": "53bdda8110ff294a417babf090debced0d75aa3524dbbaae6079f3c4d3e5d031", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764419, "uuid": "9cfde866-6115-4c7c-854c-e5447e4864e5", "comment": "Malware payload (AgentTesla)", "value": "f4dedead744e50f5047dd09d154818eb21bd0d7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764419, "uuid": "eccbd94a-eeef-4b1b-87b2-85369c78df78", "comment": "Malware payload (AgentTesla)", "value": "9a4eb0b41d8ba78c7cddf2733be40b64d34a667c6a3331d6e7a4f0d7f0b4bbdad6061a420308baefd7f76bad72260683", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764419, "uuid": "af011187-1054-4ad6-8a63-e9fefed03251", "value": "T16AB42351FC5DCA5EE7802C8094B1A9BE6B731B83193D1404D2D8B6D1E56DBFE6C404BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764419, "uuid": "875276a6-6819-4f2c-8bc7-e2f14db92029", "value": "6144:8JfL7e98BxPh9NlLjju29anp95UShZ7s9EBDS4IapyKzcLLc2L/BcM1aJBBry660:+mWBrN+75zY9WS4I6gSBry6sgcZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764419, "uuid": "a3f4dea6-5549-4a33-acb1-d8391106bb88", "value": 534658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764419, "uuid": "ea1dbf09-ed07-4569-9a95-c153334dd511", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764419, "uuid": "d0f89172-e176-4672-9741-ca5e9d0512e5", "value": "RFQ-110146.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6302c2-4d61-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637784374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784374, "uuid": "c124c4f3-2010-4497-96aa-6f201512e22a", "comment": "Malware payload (RedLineStealer)", "value": "7aa6dab9fe118c4b7a3bf638c6629475", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784374, "uuid": "ea479ce8-b5ed-4639-9f9f-245ab5ff6773", "comment": "Malware payload (RedLineStealer)", "value": "53be781d925c90c28f700293c4713000ab42cc43412b9532f69b4d0ec3b5a0f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784374, "uuid": "8cf98fd1-6035-476d-964e-5391e14b6afc", "comment": "Malware payload (RedLineStealer)", "value": "bf189c6db2f65b0bd052793c9b139d9b397bfee1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784374, "uuid": "7b99f607-4743-4575-9d46-a59a5ad468b2", "comment": "Malware payload (RedLineStealer)", "value": "912633ccc755dfeb09d6e6eda915f9fed3103853c967ca730942831836fc881f5a538f87c71c51725f73cbe2a9301b43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784374, "uuid": "033f07d6-e732-4f0e-b53a-569906f126fc", "value": "T1C0B41F1F35C2C214DA4B3776C6A3EB11BBB214DD432357DD5B48AACC8B8A1712F49E98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784374, "uuid": "6d0e999a-ef5b-46dc-8a2c-15d91e90b9db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784374, "uuid": "d0162e0a-9da4-4436-b3dd-a00b091da8bf", "value": "6144:gIHCY/J0P5vFz6FQYlM61zi8sLtqiC1oUZYJongGFP:gBY/yz6SkM61+8gUZpgKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784374, "uuid": "35bfa04b-52be-47bf-b520-73f918ff81b3", "value": 533912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784374, "uuid": "3cfc4ffe-8b64-43ef-87d3-0ab37fc6c6df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784374, "uuid": "a66a23ba-c39c-4d53-9606-874dc8b900a3", "value": "7aa6dab9fe118c4b7a3bf638c6629475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630ab72b-4d27-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637759210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759210, "uuid": "42c9e58e-a1f4-4237-a456-031f57923e88", "comment": "Malware payload (Mirai)", "value": "badf9e1945710bb7308864c3e67c3ae6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759210, "uuid": "7d174f89-bd0e-4388-87e0-eb70b29bd247", "comment": "Malware payload (Mirai)", "value": "546048adf85d524bc7cc38d5bd7d8db4e37166e22ac4df7724e9eaf1b548288d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759210, "uuid": "e06bfa7d-9398-4427-be44-00e033827356", "comment": "Malware payload (Mirai)", "value": "3ef0d1a7245ed08957b1c745253bcad37123fbc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759210, "uuid": "738f0302-dc47-41ce-8b2e-07af5abbe47f", "comment": "Malware payload (Mirai)", "value": "c003e66d546a80749bf29f582a8231712cc67d9a3f5947cca6dfe7e6b896c2c68b5a336c6ac492531214d4630fff4737", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759210, "uuid": "e3689d97-7188-4d9c-820a-e30a1ebdb026", "value": "T113B34B01F7584B47F8A70EB5283F2BD153AEDAC021F0F5846A5ED60A4172E73295AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759210, "uuid": "2a277083-8b17-48ca-a9de-69dd01144d2b", "value": "1536:E6Q0z221pgaJxCepHyqIVr7s1ibaXS3GWGRyW3XkoJdrlanDUS/OU8br9:tQ0HbEe1ufbaXGGWC3UWhaDULr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637759210, "uuid": "f40dfd51-ecc3-4d36-8a82-972176f7342e", "value": 112132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637759210, "uuid": "fe872c9f-54a0-46f2-bde2-2567be77ce9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759210, "uuid": "cc62e249-facc-4c61-8291-7be545f5df5d", "value": "badf9e1945710bb7308864c3e67c3ae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460c3575-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637778918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778918, "uuid": "01041d0a-1396-400c-9340-148a6e124075", "comment": "Malware payload (Vjw0rm)", "value": "44320047812eb57b95d19c5eaa5e4924", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778918, "uuid": "72362ba0-fcd6-4887-bee8-35f500670678", "comment": "Malware payload (Vjw0rm)", "value": "548c52528954028e61b2f7e1ceca1cf88b391cfb0ca6595de70801a75109b25f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778918, "uuid": "2f5fe209-49d1-4465-a093-34f127914dd0", "comment": "Malware payload (Vjw0rm)", "value": "5a123414d5bcfeb56bad3caf3ccb2465bc000051", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778918, "uuid": "f8e7b556-d2b4-4c9f-8cdd-5070fcb3ccba", "comment": "Malware payload (Vjw0rm)", "value": "81e1a3a42c4d20400d1ee3023b29e2c16aa23681e589e848b26335807423428efddd62475ae24f732f808ee0e8f9747f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778918, "uuid": "be0e2254-00b8-4539-9f12-fc7908b2f60b", "value": "T139B3BFFCB9A0820DD7C726A267853E20D8B493DF109940F7AF40BB2F2D61A5E5C947B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778918, "uuid": "48752ad1-afa7-4f03-8793-53ab034a38b0", "value": "384:mCJ/VUxkGUFOwgKTIU3wJBL0Gi0CiFrJEYN1gYcpYyfZ6Otp/2XE724ZF/aM:mQVMDJ7iRi8IgZ1Mg/2XEy4Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778918, "uuid": "389e0374-9261-417e-9ba4-14e493b8574e", "value": 111962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778918, "uuid": "b4d1bc13-346f-4fdd-8e28-6f9b4c8b2b4c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778918, "uuid": "1f1055a6-1917-4312-a236-549282a299fb", "value": "IMG-112421.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6516a605-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637778970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778970, "uuid": "d81d1e56-008a-40e3-b112-aa1d477e21e2", "comment": "Malware payload (Formbook)", "value": "2f4a641305a6c4b1305fd16dc10a3208", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778970, "uuid": "b62fe77f-7999-4038-ac27-15ddb2973594", "comment": "Malware payload (Formbook)", "value": "54a2b990b0c2c302de42b6b5a6f567e65271eb94594c1a914a28adaae28e571e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778970, "uuid": "f4a9a58d-d0bc-4238-8776-a2ecb7817cad", "comment": "Malware payload (Formbook)", "value": "733481d92f7a52991689f7caa5359edd33977277", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778970, "uuid": "ea72d38c-84e1-4b30-9361-f2b2cf080e4c", "comment": "Malware payload (Formbook)", "value": "582c90eafe75e763157171d17dda0997cb8c82e3aa643677049799f063aad6723cef3b6b2583b358ecca64269ca801a4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778970, "uuid": "7a54f5e5-2880-4300-818d-5239adc11c41", "value": "T1A2C40295379AAB97D83907F60C3190C0137279266964EB1EACC922CF1A32B151776FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778970, "uuid": "7506abe5-ff1e-4bd9-ac5d-99f6cbeb8ec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778970, "uuid": "11af2f9d-3157-48fe-85b0-fbb4b1629927", "value": "12288:atD009c9LWDjbrZuT1cF3SmDdSFpqGPfhFf049P8Jw1Qf:aC0Ao2ainPfhNpIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778970, "uuid": "18a7e1f0-30e5-404b-88a2-e6ca22c20fc0", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778970, "uuid": "fbbd0a0a-9b3c-47ec-9830-ebb8aae39f1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778970, "uuid": "b3518297-7976-4b43-b6b7-7aa3212bf492", "value": "DHL - WAYBILL 44 7611 9546 - Joao Carlos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bdb28d-4d33-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764521, "uuid": "08ef663c-8bb3-47f9-8c87-75cb0f0f584e", "comment": "Malware payload (Dridex)", "value": "e59387c1bec6dc3ca912d5c4168480ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764521, "uuid": "f30729ce-68c3-4b44-ac4d-b0c92a1bcb5e", "comment": "Malware payload (Dridex)", "value": "55387351559fca536ed4b88091f68a39304da9dae1a01d5f1bd8461f23034942", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764521, "uuid": "52327894-0402-460e-bf99-3e1be5f39c6e", "comment": "Malware payload (Dridex)", "value": "77eecb292a588a15778b4abe3b8244829835b659", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764521, "uuid": "ad96c027-4be5-4a0f-9b19-80d104ea815f", "comment": "Malware payload (Dridex)", "value": "f553b2b7135061c41e25d2de5968eeb6d385b88cd045bbbc80aaebf6f86135ad32d237d08b1f42d5771708517811a785", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764521, "uuid": "831a29d3-d0be-4932-833d-01bd06c46b0b", "value": "T14573F11C42A53860E1A1E73DCB0D58F76A672E675F40AACF1858EE5847260D7EF8B10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764521, "uuid": "63b7de0c-711b-49c8-afb0-1f62e05b3d11", "value": "1536:UWVPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5h76OV3ZQTUGa/hv6gdx:VRqmc3/q0dfaguKy76seAx/hv6gdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764521, "uuid": "f4b1941e-8e2a-4423-bf09-ed7337648f11", "value": 79298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764521, "uuid": "ce792c4d-e05a-47ab-a8f2-436fccbbca87", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764521, "uuid": "a51cb6f3-632c-4930-9573-e419cbc74474", "value": "Offer 39052.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13407dfe-4d50-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637776685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776685, "uuid": "0b53afb3-847b-4a28-932d-59a0c77f7dad", "comment": "Malware payload (Dridex)", "value": "c0ba3e41c19da601eb852e9cd468012b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776685, "uuid": "9473f80d-c9f0-4d11-b046-9e67b37ecc68", "comment": "Malware payload (Dridex)", "value": "56e7b2005961a0726ac94e50ed03bfcad15700e3aee1be840ee2b827f7798680", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776685, "uuid": "972fca11-f1ce-40a9-805b-cf5819acdebc", "comment": "Malware payload (Dridex)", "value": "151cad874dce5400b1cdb1a4f6114c296311f76a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776685, "uuid": "ac8796bc-38ee-4386-8a85-22aa5bd2048c", "comment": "Malware payload (Dridex)", "value": "7a6aa10f277bcf16f9b47d1123ebdd92ba9e52ad5d783e8adca29ebfd53849f2723bc0c17d7677f04723aee7666348af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776685, "uuid": "59aade5b-3e4b-4cb0-adc0-99c071fdf2df", "value": "T1EE93020A91D2F459C0E5A0FE868B14F189260A4A594BF93F3CFED5780B6418FDF8E25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776685, "uuid": "7d01ebb6-ddee-416e-a7ab-68ff3e78868b", "value": "1536:UW3PFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbtzBTt/4Y3dJnHgdA:VyFzIsj8aipSW4vHREQ4iZKUb9/4Y3jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776685, "uuid": "0a7fb7f4-4bb9-4c45-90e3-dd7599661f5d", "value": 92756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776685, "uuid": "4c4bf3ae-3c9d-48ae-8f30-73881c36d76e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776685, "uuid": "36a64f97-ce1b-4b35-a628-6ebe6b0e20b6", "value": "payment8642156.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9a519a-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637762766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762766, "uuid": "a1cb0fdb-b8c9-427a-be6b-5b548390a48c", "comment": "Malware payload (Formbook)", "value": "108639e22bac66398ee401211b8f2b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762766, "uuid": "6cd8bd7d-d81a-424e-a6d2-a0a34f6276cc", "comment": "Malware payload (Formbook)", "value": "570f6cf56c833b755dcf8618a0182d27fd9ac39a0ad4595ea9a774f346970b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762766, "uuid": "0858fc20-14fb-484a-97f4-291e348ac791", "comment": "Malware payload (Formbook)", "value": "e295545fa21f0ae51808e8486cd9b3a7261dbc52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762766, "uuid": "42284a8e-8c01-4c1d-974b-b73b223cfd98", "comment": "Malware payload (Formbook)", "value": "ca3e2895c903718217a2ec4df4fad53e3d172a16a22b604fa3f8c27e04a6843463e8df2b1b5775a66fd854b4c410d8a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762766, "uuid": "f8e89425-4e6e-4f0e-ac09-15e51db63617", "value": "T100A42E2F3A355A62ED0FD23049C14A44BB670F036A48AADAA7CBDBC6D74F09E5D44CC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762766, "uuid": "399ea68b-e664-4d56-ba75-180ed2d41ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762766, "uuid": "7e6c0bfc-bb61-41a2-ad44-6347d620c976", "value": "6144:AE6z2gX6z4bsuaBcraU2xby4Dj2pLdf8iKTmEu9999999999999999999999999g:66+raU2Ny4DqpLdf8iBM581nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762766, "uuid": "8e1e81ce-53a8-4fae-92cb-90e68d509487", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762766, "uuid": "01dc2b02-7d49-432f-a7d6-43e68becbba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762766, "uuid": "038fcb72-ec48-4578-bcaf-a5b8c98b1192", "value": "Env\u00edo diciembre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29120d9a-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637782305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782305, "uuid": "3e02d57f-d357-44bd-b92f-bcae35b4dc03", "comment": "Malware payload (Formbook)", "value": "bf0b99276257adf265da9d2a0ef43cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782305, "uuid": "e1556ba2-eb10-4cc2-87de-f465d97a3130", "comment": "Malware payload (Formbook)", "value": "586e65df6337c02078f617bdcbad67cc055c79df2f1c57899789cec1d65a7939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782305, "uuid": "93af0249-5c3c-4404-9bd1-48abcf5c41e7", "comment": "Malware payload (Formbook)", "value": "f7a2f67bcf78acb7389656a2b27472071a8dfdc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782305, "uuid": "bae1ac5d-88e9-4fbd-8226-6f23ac054fa6", "comment": "Malware payload (Formbook)", "value": "2f95ff71459a786cca79af3a14548275fb35309bf0c8b401cb34c522acad91701aa9e74a0dacf4e8a2c4b7197882b6c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782305, "uuid": "badeb8e4-bc2e-4c81-a99f-9d95af3e3c2d", "value": "T18FB4025432E5A263C8BD0F36185155801BB2B7412911D75F2DDC2B8E7EBAF8F4B12BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782305, "uuid": "e882de71-d67d-4f79-b3e7-0c17a58908b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782305, "uuid": "e962a80a-fccf-4ec5-87af-be69df3e2dec", "value": "12288:1ulw0q/WR0ZEP45YUGwJqHqpm3cNhCS7zqmvJS2H4wv:1unqeRh/UbwHqNTCIzqcrYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782305, "uuid": "1f7d6160-953e-48a8-bfd0-d5de07017b65", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782305, "uuid": "a81e9abf-6ffe-40aa-9f00-dcbba8a3cb67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782305, "uuid": "dab892aa-c051-4a77-ad14-ddd2334fc89b", "value": "bf0b99276257adf265da9d2a0ef43cfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5921ce-4d27-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637759195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759195, "uuid": "840dc1a7-f91b-428f-9876-55b1e00a55b0", "comment": "Malware payload (Mirai)", "value": "1a08447e8dd3b8adf0622faf3ff18485", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759195, "uuid": "7f27cd97-352d-48e1-8143-54929209b580", "comment": "Malware payload (Mirai)", "value": "58880a8ff9f55ece3e0a414787b5062d7c00842a89fd0eb44682d7714a8474a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759195, "uuid": "e601fc52-b13a-4cba-8899-05e150acb77f", "comment": "Malware payload (Mirai)", "value": "9657234f71a1e9362ab8e8cff2aef4cc77e2a4e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759195, "uuid": "01081534-4d2a-4f88-8f34-dba6264728ed", "comment": "Malware payload (Mirai)", "value": "0c6f91b541862bb9816c27dbc21aa50c121167a3d318e7790feacd7536a720a1561674e2cd53cdf11acc86ee9fa39ae3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759195, "uuid": "f68bbb61-e4e3-4860-8700-60e2826606be", "value": "T1ABB3AE21E1A46DF0C0A54B3075E4E93A8772998422972EF7F2D4C73D5087ED8B41BBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759195, "uuid": "e26dfdc0-d400-4b73-95e1-f91347b5aa43", "value": "1536:pOap/vYEBiwt+XfVetp0EsuLSMiPto0rrnTN23DAexYJKYLEIE1mzCVyT1iUCl:8MH70jc7Y4J0rjMXxxYA1mzxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637759195, "uuid": "988c87a8-099a-41de-af45-8fd403a0d13b", "value": 109404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637759195, "uuid": "2165345f-c22c-4362-9d12-e7fb84158e10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759195, "uuid": "25aa7da6-0e3d-4a2b-967f-e2bb17c7b504", "value": "1a08447e8dd3b8adf0622faf3ff18485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee752e8-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637782288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782288, "uuid": "39f89072-18a2-4bb7-a3e6-c1dca52269dd", "comment": "Malware payload (AgentTesla)", "value": "211855730bb030d0672ca6c0462d5e1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782288, "uuid": "35177a17-ab16-4d5d-ad72-dcf9922bbfa7", "comment": "Malware payload (AgentTesla)", "value": "58af5a5798c0a1676aaf191471f73575ea31a886cbd5c7d882b9998b0b1d83a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782288, "uuid": "fcd5fc3a-0690-47c3-b949-cf1abfebd084", "comment": "Malware payload (AgentTesla)", "value": "aa255f0261479f276c3a1bc4d7cf75d97e37e636", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782288, "uuid": "ff23cfef-0ac8-4540-a91d-a9e20b484a2f", "comment": "Malware payload (AgentTesla)", "value": "869eae7c32b1e63bc072f728ca8b32dd3a4d34bfdfa616b0f327d41ae237d6ed8b6db89bfab9e40fbc72d5bc9ece439c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782288, "uuid": "80b1d9ae-6d94-415f-935c-4a2acc291f81", "value": "T1C8A4E00426E9E1A9FC7FFBF41CB5B5C40774F6E6F881F2DEE980249A58627814E50632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782288, "uuid": "41d762dc-022c-4dc2-83e3-1bf4076597c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782288, "uuid": "be2367d8-ec90-4064-9849-7e1754a91ea1", "value": "12288:7zQWBbXOxqQSz7RYUuJWp2UwR3zgWrfxK:hOxqQSzOjWp1wFNbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782288, "uuid": "7b7e5726-d602-42b8-ba40-319744b6b8ba", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782288, "uuid": "2b5f5a6c-0372-49b8-adc6-d3e37ca2734e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782288, "uuid": "3297d160-2911-423f-b6ab-9f4a0d5efed6", "value": "211855730bb030d0672ca6c0462d5e1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575ce107-4d69-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637787537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787537, "uuid": "1426783c-ca61-4a07-b3fb-92e1943f44a1", "comment": "Malware payload", "value": "9a288acdafcc3174009d440707be3aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787537, "uuid": "695d3440-a0f8-4ad5-9f9d-7f4fde45bf21", "comment": "Malware payload", "value": "58bef95d2f1dc3d23b16d982a452e982d4812eee455bc90b2c8694e5e58eec28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787537, "uuid": "86433446-d2c3-4640-b63b-be48cc9e95ab", "comment": "Malware payload", "value": "19d4f60c3314a62f1aab033940aa60d2ffc18761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787537, "uuid": "40dc8d89-fd23-4f55-ba44-c76d40a78c8c", "comment": "Malware payload", "value": "54df4f6cb32a3b0c0a3eff3432daf5796bcf3288b097c44183fac7bdb382b908091fbc9ad3fdd13915a17c50d2e40731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787537, "uuid": "7a40ccf3-42f2-49ad-b245-26a56474d0ff", "value": "T15AB49E1AFBA40475E067D13889B38646E7727C5A0B60DADF2364571E1F33FE05A3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787537, "uuid": "7d8a627c-5744-41b4-b6ae-edf8f2f0fa59", "value": "8c1ecba9b22e62a6fc79d77bc4fb2be7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787537, "uuid": "05f56b44-b02c-4fdf-a2c6-5ab8ad43151d", "value": "12288:YJU3y3g7+T/9DIzFdAcXoNN5akvnAeLEL50f3DwL:YO3S5TeZdAcXYNLuLibi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637787537, "uuid": "e278c43f-32f0-4a35-911a-bcc94fce967a", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637787537, "uuid": "a38dac80-8471-4398-a46d-3fa515cbaa19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787537, "uuid": "91feb18f-6514-4dd6-a3be-9a4a9199cda2", "value": "58bef95d2f1dc3d23b16d982a452e982d4812eee455bc90b2c8694e5e58eec28.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db58b54-4d3d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637768757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768757, "uuid": "03bb9acb-6055-4001-a9ff-f0093b18c7f1", "comment": "Malware payload (Heodo)", "value": "ef42c06780afb557611bf6ad20c3bf91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768757, "uuid": "e8c98a6f-ead0-4bff-aa59-dd290f7429d2", "comment": "Malware payload (Heodo)", "value": "58ec8d15ce6e12b8b5bc6348f5fd5173459eb2c197de9c7b65a8f5acb8452f32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768757, "uuid": "3c435c66-458e-4b68-928f-c4fda08d7137", "comment": "Malware payload (Heodo)", "value": "0882dcfb3a71035b9380b1352b6071bdc8c7c5b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768757, "uuid": "d7ecb314-940d-472f-b2fd-3ce06f7e8838", "comment": "Malware payload (Heodo)", "value": "7350e3518fcbac7e132a1e4a22eb34487263d995c0ca85d5927eda9d5125b530e834836aa2f35468dd4e056502ffda1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768757, "uuid": "9b413d7c-07fb-451c-b1c9-b666d60c5d2c", "value": "T1DE949D1325EDBDE2D5B9173037BBC7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768757, "uuid": "358286b5-17d0-45a1-98c9-3cf1c63219e0", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768757, "uuid": "ab5c4825-f1f0-4e15-886a-69ba4bc74c5e", "value": "6144:1ACzUEcRRKxe0DUAldEzpLwE0sepO8+wM:1lxemHQtwE0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768757, "uuid": "128407d0-c79c-47b7-9ef3-30cc8ecf5f2c", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768757, "uuid": "668c67f4-ba75-4115-a1ac-9235d9677983", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768757, "uuid": "3fda312b-1f64-414c-9b4b-4df52bcc7d9e", "value": "ef42c06780afb557611bf6ad20c3bf91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4978f9-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637772434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772434, "uuid": "cd5f2455-a0d8-4a36-85e6-e7dcad03348a", "comment": "Malware payload (Dridex)", "value": "751e07abc0bc08abf349a49fd8c81703", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772434, "uuid": "85bdd3fe-d412-4c44-a731-0837e9b0db7d", "comment": "Malware payload (Dridex)", "value": "595c56c71c91c470c05c6243e46835d1b25b15c247fcd2a025ef0369e6a6b798", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772434, "uuid": "e3ce58c3-0e48-485f-97da-b44e40c1ce65", "comment": "Malware payload (Dridex)", "value": "ad977311af2765089b9bffb5bb03cb26c6ab874c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772434, "uuid": "18c14db3-4e8c-4218-ad24-30812360eea5", "comment": "Malware payload (Dridex)", "value": "52ff814a0eb042d645ce5bb4bf0e93a28d5f78fe1384004818bcbc5ebb53c6b02ee750e1638d8b61332553923c24b274", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772434, "uuid": "f0fec472-3858-4db8-86a6-d8da88720c71", "value": "T17593021EE1EA7858C0FB84FF81CA29F695330D0D4607F81A39D951B807A608FDB5A95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772434, "uuid": "4a903fc8-3616-4690-8d36-c0e3252e7b82", "value": "1536:UWgPFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUb9dsyn/fKnWFMnfy3n7Vgdx:V7FzIsj8aipSW4vHREQ4iZKUb9myn6nH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772434, "uuid": "4443a3ac-a863-4f5c-b570-41716eb1946a", "value": 91467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772434, "uuid": "c11c9881-6c4e-4d76-9da7-c6386f6c3198", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772434, "uuid": "727412a5-f7a9-43b8-a6f1-64919f178ee3", "value": "payment 435975469.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4af925-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637764864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764864, "uuid": "407d9edb-ddff-4c74-bcd9-532d09e8cb75", "comment": "Malware payload (RedLineStealer)", "value": "0f921fe477619362b7217b3c4040795a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764864, "uuid": "c8c77f6e-798a-4933-b0f3-e072bf645705", "comment": "Malware payload (RedLineStealer)", "value": "59a85abd7f2244fa12c77ca0c5b595820dc6f1c8ac58cd5f233a86625f09bc0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764864, "uuid": "10b2973b-5033-4e72-a8d5-7e5beeef8615", "comment": "Malware payload (RedLineStealer)", "value": "6559534d90ef75c72dc50d9ad6dcd5c8215dcdab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764864, "uuid": "e6e8be8b-7815-4296-97a4-ceea9ebf0f05", "comment": "Malware payload (RedLineStealer)", "value": "7356382becd195c624b01479668fe84b5f4a863abc9682b4559c286f4c79b5b3e24ee453c09cb324e59c7df0b7675b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764864, "uuid": "a551a551-0813-4278-b7dc-cca40397952c", "value": "T1395533987212B5BCDE0FDB34A3341A498F77C900E7442D556FA05ACFB2190E36EA7279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764864, "uuid": "b6e0a4d5-d875-4893-aa13-7b7a5e524d91", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764864, "uuid": "c52d0be7-2c4c-4481-9ed3-c058dd1495f7", "value": "24576:tigzrOZsZcuG5ALzajZIsirPCE7pln+Q4t+t7gAbUkEaHNYK33W5PXzqZ2:tigFcuiUFsibCSpl+vAINaOPXzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764864, "uuid": "af006c8c-ef6a-4a44-be73-d4a85a1cc5be", "value": 1388032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764864, "uuid": "627c37ee-7adc-46e3-b712-408ed74e8b22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764864, "uuid": "00f07f08-4692-4d5f-b5d1-0f94ae6a83d1", "value": "Auto_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b49d7c-4d76-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637793363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637793363, "uuid": "b364b620-4b25-4a52-9578-7483dfd65fd2", "comment": "Malware payload (RedLineStealer)", "value": "78d1d8b47063a5a5e5ccdecd019cf74a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637793363, "uuid": "3501d2fd-1b0d-4bbc-aab3-5f55766d5f37", "comment": "Malware payload (RedLineStealer)", "value": "5a15ece1649a5ef54b70b95d9d413bad068b8c1c932e2275d3845fadee8e1e22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637793363, "uuid": "07a0689c-5109-42e9-bcbc-7edb7ea97563", "comment": "Malware payload (RedLineStealer)", "value": "eb73eef0964d6e5c18298e96769a9ae9bc46152b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637793363, "uuid": "f25b3317-eb02-4705-b804-737cb10010c4", "comment": "Malware payload (RedLineStealer)", "value": "d077de2679b2b65819fe09466567c6237b64acc5b6a7e20bc5e71fcce1648c745dc2869da0a07eb7d8c0e295b813fcd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637793363, "uuid": "784a199a-2a2f-4d1b-acc3-2ec81d497294", "value": "T165563352EF919531D1326E33502AA751737A7A311BD8DA0BA3C05B7D8A32DD0E334BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637793363, "uuid": "382214f0-a5c5-4f7f-a11f-3e33c5b8aa45", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637793363, "uuid": "4552ae98-29ef-462f-8e36-caaf0f101e54", "value": "98304:PbNDp9rTdiYuZWZ/xK7yLobM3Lm6wxOjlWJzscojwosUIrNTlXnF/0p2Gspf0K09:PdTdOZw/xtp3S6w2dcbosrRlXFczaeXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637793363, "uuid": "e9572aa6-ebf8-43e0-85ec-b03f035b461e", "value": 6129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637793363, "uuid": "86444122-80ba-431e-ab8b-19121c67129b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637793363, "uuid": "6429c66e-fb61-413c-bd01-4f17194333a5", "value": "5A15ECE1649A5EF54B70B95D9D413BAD068B8C1C932E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca2e9d5-4d38-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637766742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766742, "uuid": "44464c19-2784-4a5a-9e69-c56198e47239", "comment": "Malware payload (Dridex)", "value": "bb816b6c1d2e442eda4da5a998b95295", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766742, "uuid": "d7f1fc3b-fd61-40fd-8c2c-f64769eea94e", "comment": "Malware payload (Dridex)", "value": "5a2e283ef238172eaffebf3bb9691bc846e072b7d6e831ec9dc9ed72aaff4061", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766742, "uuid": "89ba1f62-181b-4016-bb48-0dfc09479500", "comment": "Malware payload (Dridex)", "value": "58c3488042a58fcb6e2677fe38e443baef46904b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766742, "uuid": "c41873dc-8881-44dc-a1f3-8e3cd0a7f7b0", "comment": "Malware payload (Dridex)", "value": "0979218b9f11232af8257c2ff0d598857980062d4735f0c0f6e3decdd7bc802abaf20441226d1764fc643c212b110c8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766742, "uuid": "1f68d198-7284-4bf6-9bc8-ce2a0a2eeffa", "value": "T1657302E9F4D5399CCA5A953CBC1B1CF22815404562A1C38F1C64FB485DA23AB1FAD23A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766742, "uuid": "15e0ebaf-2087-42a4-a5b3-3b56fea89519", "value": "1536:UWiPFwJpvc1e+BwT8YIbDMz+1d6xqLuqQUJi0u/u8M2E79HiEBgdVB:VFMrbDu+1d6xqLzJ4M3JZBgdVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637766742, "uuid": "cf672176-fccb-4384-8f50-cfdcc0f6ab21", "value": 79532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637766742, "uuid": "d50f6265-0460-4ecd-b723-219bb63ac4d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766742, "uuid": "f4c99c24-d523-4782-b015-53211cb2c985", "value": "offer680834.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329fa0df-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637764712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764712, "uuid": "2150e726-237a-492d-a7b9-d30262bb5a30", "comment": "Malware payload (AgentTesla)", "value": "daa9e2df2b71a6543ea7cacd7838519f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764712, "uuid": "97792e24-4ce3-4be0-ad9a-2910147fec1c", "comment": "Malware payload (AgentTesla)", "value": "5a2e813f79a7486ff8bdbcfb626bed627ce6ce1079f11e6217250e01d9d47d1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764712, "uuid": "fbc59a42-05ad-4823-9bfb-fca931ec3c8a", "comment": "Malware payload (AgentTesla)", "value": "131deedc6a0269229bec491d24ece4486a0e7b08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764712, "uuid": "63f68bdb-3bee-4942-9292-b23ae00ac81c", "comment": "Malware payload (AgentTesla)", "value": "9ac9aad21990d08533f96cf9196c2a3fdadb44bad301a585fecdd08a1d780b25738fa1caa164b7eb22d5848cf0e41f3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764712, "uuid": "dfbc3bda-e274-428d-b7d5-4d8d024826ab", "value": "T13894AD77D7EB4A5AFA960B34ACE300C006FAFEA11443DF4A0484BD59B45E75EBE12913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764712, "uuid": "bc590d04-c7a5-41de-bfde-bdf9fd3b283e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764712, "uuid": "4bdd9d65-77f4-41c3-b96a-052bfcc1d56c", "value": "6144:tplA4tdzu5wYb6lyLjU0ytvCQSYg3gY/eKBcNYw0mEGrOfYCT6X25C+wOC+e:NuCsc7JhJgQYWEoYaEkwYPiC+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764712, "uuid": "6f7cd106-6144-4669-84d5-92cfbc790d37", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764712, "uuid": "eceee47a-ec26-40a8-bb7a-c2a8403b9e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764712, "uuid": "ba846c43-6b57-410f-b6e0-390b1d186ab3", "value": "originalcopy24112021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c75d682-4d65-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637785827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637785827, "uuid": "be20fd33-e73e-47b3-aec0-16b0e61b324f", "comment": "Malware payload", "value": "08e9ec8c83b9437f72f2d5a2b2127b99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637785827, "uuid": "0e2f4b3c-4852-4339-9813-18813401e3cf", "comment": "Malware payload", "value": "5b19d2bde1fc83a6dc6cd61e9206ea0e5e866fffe7257724570d2e8670410737", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637785827, "uuid": "0a07d216-ee1b-434b-b721-a9e5cd584da7", "comment": "Malware payload", "value": "a9f1f165b6c2f1def1002d7d769d48fe62928c56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637785827, "uuid": "4485d965-b675-4815-925b-279b48f1560d", "comment": "Malware payload", "value": "dcb5a54dce23dbc7c007512c5e0242c018da19934511685a521419718047a776d39ed38f2443b7974235168fd8115f7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637785827, "uuid": "279db09e-f6f6-4d89-b15d-ca0d12787440", "value": "T18AC4E0983250B2DFC827CD368C646CA0A7317567570BC35BA487129C9E5DA9BCF226F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637785827, "uuid": "983bda2e-9a8f-476b-849d-ca8f69f0916e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637785827, "uuid": "8e204652-02e5-46b9-930a-81141b740277", "value": "12288:BGDk+8y3d+Ynk2zZO4lgUIidnhRrJrchtD00YusQZ2zir:MDk+j3/k1xhCnhRrJrchC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637785827, "uuid": "33415e3e-2d0d-465a-9aff-90e0182948d8", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637785827, "uuid": "78f46d4d-6f46-4127-92a1-87eaea7455a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637785827, "uuid": "f02e004e-2a04-4f29-9020-5c861b5347c6", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e03af0-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637780387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780387, "uuid": "f12a43c1-6708-4903-ab4f-e6480ddb5580", "comment": "Malware payload (ArkeiStealer)", "value": "21f57a8b7e67c5423b3dee3904cf288d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780387, "uuid": "d4ee63aa-95f9-438b-a9f9-fb0cacb0c7c1", "comment": "Malware payload (ArkeiStealer)", "value": "5b2533a35f7917c8e12a3c24213a37bc5ff1477425a56f7c1d034d85a505f383", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780387, "uuid": "c92bef34-2792-49f8-aeed-24c4e977f55e", "comment": "Malware payload (ArkeiStealer)", "value": "065dc3317b12928b4a90879dcbc4fbc3cb6f898e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780387, "uuid": "c30ac411-2e30-45c4-9303-ecdd0f596c37", "comment": "Malware payload (ArkeiStealer)", "value": "785d2ec67541909198beb8c91ad4d7f84c2f1613e68eee6603ad533854db3908e9990efa41bf922b905a295280178248", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780387, "uuid": "cbc1c727-1a0c-4cbe-9a8a-7328d2d651db", "value": "T1BB14CF213AE3C031F99B5A3065F0CAB51A3F78226275814BF7953A3E1F716C08AA5397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780387, "uuid": "658e8222-2aff-4580-8964-2cae457bff5a", "value": "7fa5c9c2dffd615fa15cdafc116d6f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780387, "uuid": "ef43025b-414a-4856-9cd6-cf16b5dda654", "value": "3072:6MeeihCiQFdlM4DFoaUR2po9eKPXEiEWxXFguea2:6MihCiQFdtDFDJp0pPX5XkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780387, "uuid": "9e8c72ff-b023-4465-9c24-f2dd210d898b", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780387, "uuid": "89bd1848-5609-4540-956f-ce8c451c5ab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780387, "uuid": "b629dfe5-1ea6-415d-ae6b-75f49f1f4230", "value": "21f57a8b7e67c5423b3dee3904cf288d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ae11b2-4d81-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637797810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797810, "uuid": "364aaca4-c78c-45ae-9864-f58fe8f3c103", "comment": "Malware payload (Mirai)", "value": "680d3865619d62c9f276471db315d35c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797810, "uuid": "c8edf50d-4efc-4b79-9ff3-c184f71e2a8e", "comment": "Malware payload (Mirai)", "value": "5c1f679c51769933ab113aeadbc48c7e56bd397c646b6cb0b1b2a047cab50913", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797810, "uuid": "b002a772-eaa8-4f62-8609-64dc64ae7865", "comment": "Malware payload (Mirai)", "value": "4a51e06b5a876f09109072c106fafe64fad2d3b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797810, "uuid": "f53072a4-54b6-4528-ba46-d261f6e1aa10", "comment": "Malware payload (Mirai)", "value": "288cb661b8dbab2b2060ecfef5b7e45da24b2db4f3be2e506c4bad520c5af64b907caf10c2ab12ffc0a89de360cf1c5a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797810, "uuid": "9920ba4c-0236-48ac-b8c7-2c0b7d74b7d7", "value": "T1CE23029E1319FC21E9393E36A9F7A16676635AB854FF70E002101F1012D64437BEB5E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797810, "uuid": "c8656bce-9ada-46ba-b484-799e2e78cfbd", "value": "768:pJFuAw9/UwUB3K0xxETKg2dKVnfGVz8R/U9hi9q3UELg3Ai7Omk3Wa5fTmUchNVh:pJFuVS7xdg2I1fZ4pLkAIK3zArd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637797810, "uuid": "d78a12e2-0ab0-4712-be8b-0a787a1b97ca", "value": 50044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637797810, "uuid": "2e9599d2-6732-4ae3-9745-48a6986a7ca0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797810, "uuid": "2ccf95e7-6523-4efb-b6d7-4e62124a6ae2", "value": "Akiru.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19b81b8-4d3d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637768764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768764, "uuid": "96abe799-da85-417f-a8ae-799bb191427e", "comment": "Malware payload (Heodo)", "value": "3102132775b47d2ff1c40a2b5293ba60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768764, "uuid": "d606d94e-10b4-4fa3-b6a0-b6cc12b93c73", "comment": "Malware payload (Heodo)", "value": "5c4d9d71040604f2a6cd8fa3e69a3af1f79590348729cd0d90abbb8ea51a05a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768764, "uuid": "1724825e-d52e-4219-b669-f082f0752251", "comment": "Malware payload (Heodo)", "value": "8d54c54e8eff10bf087236af120367620b61a622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768764, "uuid": "1cb191ed-4b57-4886-b660-bc5f990787ac", "comment": "Malware payload (Heodo)", "value": "b130a6d08a1171fd6302b0c2ad65874e5beb2be7caf8d13cd99c97e8ca056734bc5ac79e16ac0e25d239ad62740d82d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768764, "uuid": "fe16da73-8b36-4386-b952-7ea2e2df2747", "value": "T1AE949D1325EDBDE2D5B9173037BBC7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768764, "uuid": "536afa47-8e9b-4614-afac-040af6575a63", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768764, "uuid": "47de5df4-3cda-438a-a513-5c20d883a367", "value": "6144:1ACzUEcRRKxe0DUAldEzpL/E0sepO8+wM:1lxemHQt/E0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768764, "uuid": "74c99ab1-a00c-4825-b077-7dd5ada71a9f", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768764, "uuid": "e64779a2-797c-4c72-852b-96641ded18e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768764, "uuid": "aa3b8e7c-2d3b-4a09-8f88-81f1c671935e", "value": "3102132775b47d2ff1c40a2b5293ba60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39db286-4d25-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637758486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758486, "uuid": "a041f56d-19a7-49d0-99dc-c551f3eae1eb", "comment": "Malware payload (RedLineStealer)", "value": "f9a63ae1aaa804b082d77193ff8ebd3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758486, "uuid": "81cbc68a-b0a7-443b-a80c-1e9f239a3ee7", "comment": "Malware payload (RedLineStealer)", "value": "5ca0b28b8d7440a5f148503186055422b71b5dd609d9b05dea5867fa74b31e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758486, "uuid": "91d3260e-83f6-4908-9cf1-476e92a01009", "comment": "Malware payload (RedLineStealer)", "value": "5f1d37910037f4538540f82415904c140572025f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758486, "uuid": "086c481c-f06e-4b35-b3ee-03b2ab0cd19a", "comment": "Malware payload (RedLineStealer)", "value": "5efd8384bc44bd375cddafcfbb42f9bef290236cedaef6035193dead982cfa2e4d79bc8acf78fe2a617a6283ca58c413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758486, "uuid": "346bad5e-e5a2-4f7c-9104-4995790d7156", "value": "T1AB35DFB37B673296DCE840371112521F5E3F18364E870A1A217A7326E9D7E1B2C5B8AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758486, "uuid": "cd71ef2b-8183-44e9-a6c1-cb75627f1741", "value": "6e3d359b2022f544860fb6cf28e381a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758486, "uuid": "d8777cd1-9be7-4868-9fb9-c234a2d05da5", "value": "24576:ORN+QSP+auRERPkVmuhwr6Ylh+dP4miP+kv8r1hXo4X:OH+lGuRUmudYv24t2I8vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758486, "uuid": "3bfae81c-a1ba-4e2b-bd94-946ce2496f51", "value": 1094064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758486, "uuid": "e59083c3-235e-4260-acb3-c75de6d1756d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758486, "uuid": "8062caf0-dd4b-46fd-a718-da388c05f7fc", "value": "f9a63ae1aaa804b082d77193ff8ebd3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9de66b3-4cf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637737102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637737102, "uuid": "f18ade8e-54f4-4336-b6cc-9236569a11d3", "comment": "Malware payload (Formbook)", "value": "b179940e056215c2b79abd54c48151d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637737102, "uuid": "c8f8e8ee-87ed-4cde-ac64-b1b02e9d3764", "comment": "Malware payload (Formbook)", "value": "5cb813ac3e2afb9c2b947b02921f673c30db0b663cc331e4ecfbaeecfe0a13c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637737102, "uuid": "0a8f28bc-0944-4486-8e89-18063fc98329", "comment": "Malware payload (Formbook)", "value": "836eb70fac891fc538e12c7c84694ef9f4c03572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637737102, "uuid": "12c6dedf-6917-44ea-9a45-8eb7325ff423", "comment": "Malware payload (Formbook)", "value": "fe3e2c02c545ffb1626540e58fe273c7afdbb9ad6cd3c95fa280f3795a8aa82be29344bfee7b3df650ead019c40eec77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637737102, "uuid": "c510818c-f155-4b10-af21-dcca3800c870", "value": "T1A084012173A9B36ACCB66BF81D34758913B266903A15D32C9DD811DF2C31F258B21BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637737102, "uuid": "2335859e-0799-4a5f-9590-e93efe4c6bab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637737102, "uuid": "93bb9b6e-127d-4276-8583-b848ea180d6f", "value": "6144:9RhkMgmR7DyKEElJbngWsvC2OjNQgzzcMqqTpxQdQ5uTT48bQGq/OZq:9/5bh2KXD2sNQrVIu42nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637737102, "uuid": "c60d51f3-baf6-41d8-9ee4-d4486a768d0c", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637737102, "uuid": "1bdcfc12-c728-423e-a48b-6f2db7ff2932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637737102, "uuid": "5ae809ef-8432-49da-b9ba-9c0a6ffd3498", "value": "Payment Swift 101,647.09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b11c039-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637763599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763599, "uuid": "f196dd70-4768-4552-8cce-33649211c8dd", "comment": "Malware payload (GuLoader)", "value": "ab63f9ba38d9eb4f8bd57ae56a844a31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763599, "uuid": "8097ef03-7e97-4be9-a64c-dd1571cd6bbf", "comment": "Malware payload (GuLoader)", "value": "5d14499fc44a623454a0518972ba97be883b0394f16f08b4265e46ff12ebfeb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763599, "uuid": "c8b2407c-bfa0-4bb6-8dcd-22ead7e0bc83", "comment": "Malware payload (GuLoader)", "value": "bf1c2a15553f893ff180a307dcb5805c6e440158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763599, "uuid": "59d5f903-80ca-4db0-908a-049f34f08269", "comment": "Malware payload (GuLoader)", "value": "f7924b21250b0bff6ba42a484783f0ceb4df02fb7000a399299f8fef182c69c426efc5638fdd499d35fe9fdc9e323ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763599, "uuid": "23007690-6fb8-4e6c-8a9b-ef9b14acd7fc", "value": "T18ED34A37BB677EAEF0038EF1C5A604D801647C333B821A97DEC41A9B182F5CEA54D256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763599, "uuid": "c885889f-dc3e-496a-862b-f6b74fc404e2", "value": "d77040f4614bccfda7b8aa2e04863738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763599, "uuid": "7edc7c08-9bc1-4e2c-bcbb-d0090595d65d", "value": "1536:t7Do180f9y+zVLdUAcAyB/BMsZWU1/7nYp4r1O/pejim0SD:t7gZz7RcAy/Vkm7nYCr1Omim0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763599, "uuid": "447d9d2d-f30a-4c94-8e2f-1fedf1691c5e", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763599, "uuid": "79741f94-a9c3-4671-92c7-e233a23e0b2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763599, "uuid": "317bbf9d-dab8-44a0-a5d8-d071373afeee", "value": "FACTURAS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c7268c-4cfc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637740879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740879, "uuid": "dc273d96-ddce-4e30-a792-1a43a3396c1b", "comment": "Malware payload", "value": "edec48ad85961179ffbf56d40b268880", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740879, "uuid": "0752bd84-3405-4aae-8256-98397328a6a3", "comment": "Malware payload", "value": "5d97d3035b2ec1bd16016922899350693cae5f7a3be6cadbe0da34fbfd14b612", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740879, "uuid": "edee9c35-d9c6-40b4-87c2-58afffeb8aca", "comment": "Malware payload", "value": "d4c0646dbc9b3034eec80d1bc8eed87b709bebe0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740879, "uuid": "a0b73af7-c9f4-470c-be4b-4c9c54f8ef19", "comment": "Malware payload", "value": "d91beae9c166004bd98ab29fba8fa1f199a7f8f539107dbdf801ddd52150273a8db74358f01caf3f4a14c42a2f46fb12", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740879, "uuid": "f546165b-fd3f-40be-b704-2b295d594b31", "value": "T14775DF1176D6C537C06701702E2ADBBA9139BD700B32C5EBA3D85E2F6E316C16672F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740879, "uuid": "c385187c-eced-4b7c-96ba-acad349ab171", "value": "d6612a3ed6fd33f95566d0cb5aae2cc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740879, "uuid": "ceb7354e-a0ab-48f2-bc2e-0587a40c680f", "value": "49152:NgUgbYXwB3FHjD5JPz1MbEUl8VlvfxA7vW/LL4Ni:NsYk5JPpYEkMAzWz8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740879, "uuid": "11d43c99-cdc3-4edb-8a46-10ea7d2b977c", "value": 1602048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740879, "uuid": "d10b55a3-88f4-4f8b-b356-b930a78759cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740879, "uuid": "ab6c011a-e331-44e9-a738-407a77e6eb35", "value": "5d97d3035b2ec1bd16016922899350693cae5f7a3be6cadbe0da34fbfd14b612.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bb81d8-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637774898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774898, "uuid": "cb6175cd-3559-45f7-850c-a1b0c66df08d", "comment": "Malware payload", "value": "d200ab1a6e38f851f650a138b1c48cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774898, "uuid": "7430a26f-f66c-47b6-8787-dd87b3e90b16", "comment": "Malware payload", "value": "5dac7129cd63828ff2780291984cfec1a5c8b602a09ffbc836dd3a694df612db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774898, "uuid": "e361df25-9d76-4ec1-80c9-bb5eaf0af974", "comment": "Malware payload", "value": "cf909190b74297bf1ee227e8902754cdb327fd69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774898, "uuid": "c8fa788c-f6fd-4819-9b9a-81682aee9333", "comment": "Malware payload", "value": "e6ea3ee7c24b75a8af22e2407ea764a6b3668d494c59e4d73f3ad1d70fe2df00a982404d63a1ef264438cd77724f040a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774898, "uuid": "cc493709-462b-45b9-923d-2bfa0b38abf1", "value": "T11C4406953C8225EDDC60D8BA53B6EFB6026B7DE486B1FCB837805642AD7819BC570CC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774898, "uuid": "08a7ab24-ec8c-495e-9a7a-6c4d54a73595", "value": "eadb5998577209b842f9333128fda99e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774898, "uuid": "f0fc1205-0318-46cc-bf4c-3dd4d77706e7", "value": "1536:Xrmi3cz0nD6V+aDWDYqyjA5MxjGMVA/6Pr48qcex19YU0lH7X3zgvi0rcVGVPVo+:7LczyaWDjT8JeZYURiPpO2DCICBvq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774898, "uuid": "8b69ec02-03c3-4f1a-b146-39b4f9fd12d4", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774898, "uuid": "6991aadf-c955-40bb-a4dc-69344e786ef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774898, "uuid": "215352e5-1990-4b61-bc13-19b85e2849fc", "value": "d200ab1a6e38f851f650a138b1c48cea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efbfbd5-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637778933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778933, "uuid": "c70b6a2d-1a93-4863-93dc-1567278f7e61", "comment": "Malware payload (AgentTesla)", "value": "65f5d66ca3f322eb3ee56782d07472fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778933, "uuid": "d7bf62cd-3315-481b-8377-f20b221b7acf", "comment": "Malware payload (AgentTesla)", "value": "5dc895024eefc0c2ca417c30d9b98c5939b41f496778fe85c66afefe4ba81896", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778933, "uuid": "495a85e0-b838-4529-a089-defe62b3a379", "comment": "Malware payload (AgentTesla)", "value": "ad0cd2c9b86255db723025dfac51786cb0f71abf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778933, "uuid": "1a9988fd-4701-41e5-bf82-da4ad407914b", "comment": "Malware payload (AgentTesla)", "value": "2270b9bd7674342498836a31b05e487999604b6b8d39121c625fb1256258ff8af2b09c091e0195edd97fa0f6c8c69dba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778933, "uuid": "10807d26-c3e5-4d50-894b-cd4663d8cb93", "value": "T17FD40256379877E7C87A8BF50D3280C11372762A6800D65EBCCA62CF2925F115B27BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778933, "uuid": "5c92f372-702e-418d-a8be-45d6523f107b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778933, "uuid": "84ad5eb4-340f-4967-aebd-7772b60e2cc1", "value": "12288:OvwtD00f2JX5DklnJikySvK0MduFp9TKg9WgW9C4:OvwC0f2leJi5u79TKkWb9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778933, "uuid": "35de34fa-71c5-4861-9d0a-d942110fd00c", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778933, "uuid": "3f678d17-e3a8-4421-a79b-148bfa977882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778933, "uuid": "46c172a3-7531-4438-a55e-40c66ee24e0e", "value": "FedEx Shipment Notification - Air WayBill FED1007990_A10792.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66164c67-4d00-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637742464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742464, "uuid": "6fc8ae30-9d32-47ba-9035-d76b2ddc98a8", "comment": "Malware payload (AgentTesla)", "value": "5baec3b1d052305db283b13fd388e2bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742464, "uuid": "48c3f355-17da-4d9d-b789-37881cf2e95f", "comment": "Malware payload (AgentTesla)", "value": "5f6922837864df836e7ff1b3efa7b6e091cf26febb47a5e3595dd2c38a659dad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742464, "uuid": "b33acfa6-439f-4620-be8f-c8e96902878c", "comment": "Malware payload (AgentTesla)", "value": "b4932b5cfd5123fafe9a010c4f7c7ac191b28aa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742464, "uuid": "33bbbcf0-890e-408e-9639-86250e8a5aa4", "comment": "Malware payload (AgentTesla)", "value": "5dee16c0d4f3a20b7bf409063ea09c8ce4371287b692046f4c154d9e87d36a0fdb42be70de97c2d4981a0e1fc4a6c38a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742464, "uuid": "ca98da06-5572-47e6-91f3-b6b7baf2935e", "value": "T10174234A9AE28C7FC585023A12B3B5F2C37F9654616D2DDB9F301ED83DB4522870B263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742464, "uuid": "8b1d1651-5d3d-4703-92b6-1f38ce3fc4bb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742464, "uuid": "31887f35-b0cf-473a-94d1-92e7b90b166c", "value": "6144:rGi1yMSPx2pAYlrGkvdj4yz5vRa/kr4Gb7nzi8tFuvkCHXaoT4zBUiM21:wMLpnlLj3vRa8r4GbL4Hcz24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742464, "uuid": "0d8d9730-aed5-4e92-b5bf-56ec4dedcee4", "value": 354121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742464, "uuid": "e9439f01-63e2-45aa-a45b-933fdcaa4e5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742464, "uuid": "e1d116ef-4891-4ee6-ab9e-7e9ef3e8379b", "value": "Ref. # IRQ-21-07778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1337cf3a-4d32-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637763800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763800, "uuid": "5f881aba-3ffd-4630-b5fc-0a4d060bb9f5", "comment": "Malware payload (AgentTesla)", "value": "1ab50946d93523e76326e4c633b6059e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763800, "uuid": "dcd24f8f-3e0a-4db5-bc14-c0fbd0b1f865", "comment": "Malware payload (AgentTesla)", "value": "601bd4fa9ea1e59bde4b61ec10d566c8b992a498072479879b88144675b40135", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763800, "uuid": "b5c59e58-db0e-4a2c-b994-c5c9e41639aa", "comment": "Malware payload (AgentTesla)", "value": "def8f95a961f83f9fa24c172bf17e21d9736b3ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763800, "uuid": "8b8b48f9-24c4-4e83-ac5f-ebeb187a0e43", "comment": "Malware payload (AgentTesla)", "value": "620a818d7712287c50137faeb644448e97b0f80c88c5a1fe2defd9f1ece299d185b713fd699053b949a7f3703264a0f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763800, "uuid": "91892f92-4889-4c6a-a9be-53a50e6908df", "value": "T1FAD402613295D122C8760F760C30208013B3BD552961DB9F7D9D7A4E3F7BB9A4B21BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763800, "uuid": "e77d054a-5a74-4a8a-8585-53d2a1e3ddae", "value": "12288:4gJDvVwm1tv9ingQORz9HwgWEeiXPDdcG/MqzeZBS4T4myh3tcKh4x9y1:441Zog9z9HwDEeiXPJ0qz8nJRhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763800, "uuid": "a40f3090-6cb9-43ad-b6c0-e763e78aeba6", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763800, "uuid": "ec490f2d-daee-4112-a1e5-32b585c44aee", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763800, "uuid": "bb1f6210-92e3-437c-b144-f6686e3a5da5", "value": "NEW PURCHASE ORDER,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3488b5-4d66-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637786527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786527, "uuid": "2830fafa-489d-4a62-825c-0cf98c1f6cff", "comment": "Malware payload (AgentTesla)", "value": "900bd52289f05db78fb46b26d2cee93a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786527, "uuid": "0588aa18-8816-4103-a615-5a4053779787", "comment": "Malware payload (AgentTesla)", "value": "60207947230c8da0c61062458dae100f2935f7dca484bffe1d5a06188cc9f7f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786527, "uuid": "ecec83e6-9f68-4f87-ae98-807bcd1f1669", "comment": "Malware payload (AgentTesla)", "value": "d777905d77f44d0746857f874e96a0406a2ffbf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786527, "uuid": "f14d3e75-adb8-4c06-a8cd-8b5a0ac8e8c1", "comment": "Malware payload (AgentTesla)", "value": "2a55508aa661b07d7515bb7f8ac0c13fdea3595100bcb446df6697692d43a79311bef29dfbbef82072df21925a3686b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786527, "uuid": "8c4cf193-c697-45c4-8563-cbfbb08a09a5", "value": "T1B0C4E0A8325072CFC827CE328C646CA5A73175675B0BC25BA447129DAE1E69BCF116F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786527, "uuid": "4ded4e08-f5e3-4a1f-8b88-60b260f956f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786527, "uuid": "7cdb8049-df06-405c-96f9-8aeb63bfedc4", "value": "12288:sjst1LfZD26vAurTcYQqkXVD0yTULD9DLmtD007lI1PeC0k:sjst2cBvnQ/B0yTUdDiC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637786527, "uuid": "dda78967-624b-4db1-894b-020737f6164d", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637786527, "uuid": "cc33923f-9441-46f7-9452-df9b2b104aa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786527, "uuid": "a56d866a-ecb9-4b39-afc5-55bd2b1dac26", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b765a000-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637736588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736588, "uuid": "bf2b9feb-3dfd-4289-8ba3-efb0ce497a0a", "comment": "Malware payload (Mirai)", "value": "a79d89d64b0b456231a5f5c695f76339", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736588, "uuid": "4ff10756-c19d-4b23-9d5f-5c7fbf42329b", "comment": "Malware payload (Mirai)", "value": "6051d44feb68628dee58a73d2acf92cf777224f8821de0a5dd7460ab97ee9602", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736588, "uuid": "92ce0f5d-df9c-4ac9-a9e1-20bd11a24369", "comment": "Malware payload (Mirai)", "value": "f6c9c3b412cd24a89ddbc23785d20836855d2936", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736588, "uuid": "b79eae78-ef96-4692-a81c-19822c9672d6", "comment": "Malware payload (Mirai)", "value": "d7a973a23d8d101a4f709ce974ac4e211eb7db39ec3a05cc2d00b933c35381455e46f1f43c96218184ab8b45ba26047f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736588, "uuid": "1b8f4660-f3cd-4c87-89de-abf4b8d7960e", "value": "T1F2B3074AFC826F11C5C612BFFE0E0289335367A8E3EDB112DD116B25B7CA92B0A77551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736588, "uuid": "b3b5e028-45c9-4956-896e-afd4c5e02d27", "value": "3072:i5gn5ObESCfLqlhJF2LvdSaggFh31tLp9lUwZ7xwbZnB:bn5+ESCfelSVSaggFh31Rp9VVwRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736588, "uuid": "82eb0571-6865-4b36-89b3-fb1ae5801c7e", "value": 109228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736588, "uuid": "1e2b6bf4-6ae9-4487-bb41-5ef1dfc74d21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736588, "uuid": "ca939eab-1b74-47d3-88bd-d1cd31c93856", "value": "arm6-20211124-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d455cc4d-4d19-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637753387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637753387, "uuid": "66aa95d9-d1a8-4ddf-9e08-93b873da9383", "comment": "Malware payload (AgentTesla)", "value": "8643f0fe46b0b671592db3461d4e7f41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637753387, "uuid": "e4797de1-d697-4ce5-a696-d78932011044", "comment": "Malware payload (AgentTesla)", "value": "61050110e9debffe96651ac2da804ee7911b4ff6d6ce2570fb6771ed72a52685", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637753387, "uuid": "1f74a88d-dedc-4c67-8faf-2fd64fded5c8", "comment": "Malware payload (AgentTesla)", "value": "782f79c6a3f41c1b5c38a94a1615e23295b69ec1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637753387, "uuid": "6bca15d2-4d18-4612-8717-7de706e8ee78", "comment": "Malware payload (AgentTesla)", "value": "1330651468e669f638e3daf982f2cd28d03a047300e032a6aa82fbe8ea4804de4d9689c5ac8bfe095cf1498175cd181e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637753387, "uuid": "3f80712e-78b3-476d-8cad-6699b08df052", "value": "T1CC94E04321898DBBF2132C754D2DD6F210D7ADA80555A92D626E372F08F232613EF66F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637753387, "uuid": "060eca1c-c882-4cd8-9777-bdabcd1fb027", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637753387, "uuid": "726602cc-1ce5-4741-9b19-859c9744f89c", "value": "6144:TGi8AS2EL2mUt8SSbueKoNjFg240dIFX0TJUEmSZoq1KRp3P1WM:IA26queK50qe+rWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637753387, "uuid": "695a3958-ed24-4b6c-a72d-2e3b9888edee", "value": 425679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637753387, "uuid": "68d38cbd-bfdb-414b-b2c2-cf3427be40e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637753387, "uuid": "01382b2b-7ae7-4505-a7d9-8dc78115546a", "value": "ORDER #63457-BLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62e690b-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637782515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782515, "uuid": "46eb1050-da07-4642-ba31-db817c8eca76", "comment": "Malware payload (Heodo)", "value": "007664b623f5251b465f2b7e25550ee0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782515, "uuid": "a88f6c66-5561-4ae0-8628-74fd8f6ca709", "comment": "Malware payload (Heodo)", "value": "6134922a631b3169eeb0c050d0bebbada877d5936baa40cc59ddfb80efd42138", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782515, "uuid": "00d96a62-63c0-4ccc-9546-4356c1a745b4", "comment": "Malware payload (Heodo)", "value": "58cc0bb27acec9538a4211e9b428aff891f94596", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782515, "uuid": "95307b1c-40c8-4c03-8b0b-2715681e2335", "comment": "Malware payload (Heodo)", "value": "60f7c3c81ff1beef412335d1ad8a49ef32a52f26c0238449e6db0af6e53de2a0adea0090563e2235bdd11978dc0bcec5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782515, "uuid": "1dbe6090-eef5-405a-8ffc-01125dec0e86", "value": "T168949D1325EDBDE2D5B9173037BBC7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782515, "uuid": "ef98522e-308d-43fa-8676-9adc93d41140", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782515, "uuid": "0c28c3ac-2340-4ea8-a6cb-23011a8f78c5", "value": "6144:1ACzUEcRRKxe0DUAldEzpLEE0sepO8+wM:1lxemHQtEE0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782515, "uuid": "154d4d26-22dd-4e42-a5dc-6c1999508057", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782515, "uuid": "0f48f537-3fc2-4ee6-9260-edee5c053ac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782515, "uuid": "7aa14f89-db11-4752-a8ee-252def8823c6", "value": "007664b623f5251b465f2b7e25550ee0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70742600-4d6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637788009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788009, "uuid": "c0871341-218c-444a-ab8c-6abac40fd1e2", "comment": "Malware payload (Mirai)", "value": "71046c3ef8bc347bd3f199b8ac760bd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788009, "uuid": "c18e2475-230f-4703-9350-513931a6747a", "comment": "Malware payload (Mirai)", "value": "6346167e06d9913a1c72c187eee144dd468d495f428c592ed52181cdf60dd8b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788009, "uuid": "6a627daf-6081-447f-8cc0-9d326244ace6", "comment": "Malware payload (Mirai)", "value": "7dee91437f78899c6521d82121d94afc6cbff71d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788009, "uuid": "9750ab63-a27f-4261-9430-2d388cddb2de", "comment": "Malware payload (Mirai)", "value": "6c39ee943419c7c84019edcd3a80e3f2226094697d7aa936714c038181009242939b0ae78bdde26fbe6bb5dd8d209419", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788009, "uuid": "72a5a1ef-c14b-40f8-a529-5eb9f809bf9f", "value": "T1759394097FA50FF7E89BCC3749E92B05198D551A21A93B76BE30D818F24B25F19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788009, "uuid": "d65e78cb-00ca-4299-b080-b0d561d3cc20", "value": "1536:r6nbyaRrnWe45RBfA3Eid0RMNbJwaPfR/KIJ1EZoFe4:r6nbzR7IfeEid0RMNx1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637788009, "uuid": "bce3f966-4860-4bf1-964a-b4e8bc1765c5", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637788009, "uuid": "d226e058-a4fe-4da5-863d-b28720fd143c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788009, "uuid": "3da70f05-afed-4984-b3a8-e98ce9a0aabc", "value": "71046c3ef8bc347bd3f199b8ac760bd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cc27a6-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1637763608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763608, "uuid": "dd3a58af-586a-4705-85fd-693355b5b862", "comment": "Malware payload (SilentBuilder)", "value": "4083f52bffc3e3e33e3e6c1f724d3c5a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763608, "uuid": "c5373954-1758-455a-b0f8-7a0aac55d34e", "comment": "Malware payload (SilentBuilder)", "value": "66ae76229e7bf683e24ad78e8d2ab39ae9b6e36abb18abc34ce1def8e6c4c6e1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763608, "uuid": "cb952fe0-5118-4772-a34d-e4de6e0ecad4", "comment": "Malware payload (SilentBuilder)", "value": "62715bd8fe14fa8ef7251bfa4810a453a1146318", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763608, "uuid": "303fc617-e6bd-4514-8ce3-8ab3355ceb2b", "comment": "Malware payload (SilentBuilder)", "value": "a7bc500b95086e961a9da3cdfd1838d0dea6a4ca1df010cde8ae428c527504b1a678f07160ef165d99f08a5a170b7e6e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763608, "uuid": "9e4549bb-78be-495a-a1ff-f153dc3642a4", "value": "T1DF44E146796CC8DEFA57833148D79BA66333EC204FD71A876A89722C6FB4DB47912006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763608, "uuid": "8959191b-fe17-49cf-a2fc-08fa14f9d8a2", "value": "6144:rKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgScfFw6lxFT7kFWqOSMQ6HujLmH98DUX:UFrlxFTMrvbiFd8DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763608, "uuid": "212c9f23-accb-40f0-af74-054bb7c10650", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763608, "uuid": "bba803e8-58e2-4860-971a-350f08ac07ca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763608, "uuid": "f62de41c-a1a7-47a9-a85d-83d09fd5e2e1", "value": "new-1179494065.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9feaf40-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637772670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772670, "uuid": "4e958c58-b49e-46a1-98de-a531e5d378db", "comment": "Malware payload (RedLineStealer)", "value": "90f69c931a2e0cc0a7692b246ded02b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772670, "uuid": "d9915a09-b1f6-40a4-8b3c-d7273c80afa6", "comment": "Malware payload (RedLineStealer)", "value": "66c725db9e1ec7e2466654cf2866e44b8c6b8500938a91332d3ebcbd210b2b27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772670, "uuid": "8af0ea63-7768-488a-8612-6e28eaac032b", "comment": "Malware payload (RedLineStealer)", "value": "e8309f1d0da022072e19896d7c4001baaa69010e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772670, "uuid": "01b29f05-4e51-40af-946f-df8ec26faac1", "comment": "Malware payload (RedLineStealer)", "value": "97458fb4708a350f4670951c78cf13f4e4fdacaad4babdb65be795650fb5cd8ff67c1adca00258486dbf5e4bb59e359c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772670, "uuid": "bf93de86-c616-4b4d-ab89-63e4bde652e9", "value": "T185E4AF823244DDD6D4532AF20CAFC56022747D9E9524CA0E3B83BB2F65E7702255BB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772670, "uuid": "bfe1a0b7-bf63-4462-8566-6b7503c01789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772670, "uuid": "bae78fbd-e5c8-4472-a52a-072b7de78025", "value": "12288:3tD00Xyy5DuyRs9c5ssxNG1qwBaz8vs2gSiyyjK:3C0L5q790s+TwBaWgd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772670, "uuid": "be918ea0-6a26-494d-b1ec-fe8f934ba502", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772670, "uuid": "159a85c4-b8cd-4f9a-aaf6-2536c5c45c6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772670, "uuid": "799ba45a-f5b2-485f-a759-f6ecd3b84023", "value": "AMAZONORDER784948489494PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f24688f-4cca-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637719206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719206, "uuid": "880baa73-d55c-48db-986d-284286b65f85", "comment": "Malware payload (Mirai)", "value": "b704b48a71b90abe68f06bd23f70ea0c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719206, "uuid": "b33c01b7-6590-49b0-8be0-934c875aeec9", "comment": "Malware payload (Mirai)", "value": "677c467db266116f40f3f1794f3ac476ae93ba83d8118b2a1234859bdccdd038", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719206, "uuid": "344e9224-2ea4-42c0-9be7-8e4e26543f9b", "comment": "Malware payload (Mirai)", "value": "97a7ee9062d1fe599816201baf7f0739536e25bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719206, "uuid": "c5bddb62-1d40-40fd-a61d-6efb6cddd360", "comment": "Malware payload (Mirai)", "value": "60edbb28ac0e93b7949d84e8dd8aab3d5354bbbec7e3534f0a5db3dc6d86ca5c27e404007f3b7d038224c98237d562d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719206, "uuid": "dfee2a39-4d28-45c4-a139-c8089ad0dc45", "value": "T1D76318817C80AA26C7D0077BFA6F108E3314ABD8E1DA73478C151F9576DA81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719206, "uuid": "2c7a4099-1a35-423a-a12e-102c49f55e9b", "value": "1536:VnKvL78wqgjqsWFdNaqgtyDUOQ7JLOQObOQtTzpJeZWScYvtM:VnA78AktTzTw/3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637719206, "uuid": "087c8571-1b61-45ec-8eef-6a978ffc756d", "value": 72236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637719206, "uuid": "670fe051-086b-49cc-abdd-f9b77dbe8a7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719206, "uuid": "a4f98d32-02da-4b37-aff0-ea1b5f7931e8", "value": "jydygx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a898060-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637772537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772537, "uuid": "54eda988-d351-4764-ba2d-c0d0862c5578", "comment": "Malware payload (Dridex)", "value": "18363d169ce47cbbbc620ac11362f078", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772537, "uuid": "dfaca882-d26c-4a8d-8def-dd1099c8b7e3", "comment": "Malware payload (Dridex)", "value": "6865297b72bbfe341d91e32e052debfae3bcd41d8cd883f6bf4a2d665fa00b0f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772537, "uuid": "bed997ca-9931-4a3e-afdf-3acacd024298", "comment": "Malware payload (Dridex)", "value": "e6afafdd6c583e32f8b6cebc286b1892fb6acb3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772537, "uuid": "f4a8edfd-76bd-4246-8515-a46ff3e62053", "comment": "Malware payload (Dridex)", "value": "cf88f3b2d2cfa8faa0316a2c8bccdd47dc198ce592f8a418849d928d7f26cc4763616a900bf47b0e43d349ab76d7e6ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772537, "uuid": "e08d991a-1ed7-4bbf-90ed-8d722dfb8cca", "value": "T13AF47C67440FD860F6C58A3977BC6885ED85E2628F123FBAB9422C2563352BCD5B3317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772537, "uuid": "ea424c68-c7b9-4a10-8e1a-6dc1954b537d", "value": "3408863a87d01409eccbe58d6d3e764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772537, "uuid": "c69faeee-a8f0-4977-b05c-c7eaf34b673b", "value": "6144:jmHk0ZwiaiIiu4KiU0OiaiOw8i4isCAiKeoiyj3o10Yxc7Ijse4WjPPMOnnnEi1m:lQRDlh/tRVPT1rTjybATge4W70Onn1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772537, "uuid": "7df6a853-0961-4fd9-940a-6190c39fbf6c", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772537, "uuid": "81d2193f-69cb-4247-8492-d0be0e163b85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772537, "uuid": "7896bdd0-fd32-4e82-b04e-ca7796328e6b", "value": "SecuriteInfo.com.Variant.Fragtor.44159.18448.17087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967d14fb-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637779053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779053, "uuid": "78ecd300-5f3d-4bb0-886d-9e8dcfb28685", "comment": "Malware payload (Formbook)", "value": "8877c304368ff62890dd1658c18c5559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779053, "uuid": "b7099b2e-67af-4bff-a4ac-6b7af9a64a5b", "comment": "Malware payload (Formbook)", "value": "6898def472a85a7988f644d93880b2ab11915ceecd04ee345b49b54589564fee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779053, "uuid": "849849cd-3b6f-430c-99df-3618b564487e", "comment": "Malware payload (Formbook)", "value": "14598d4ba752e16938acf3b927205cb20404a87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779053, "uuid": "ac5585d5-c8e4-4842-b2dc-585291419a84", "comment": "Malware payload (Formbook)", "value": "cafff1ae16e2afb7b7434826e18b590645064827678480436595a1d7283c8dc29fefc8d6427921163a09e929438c8eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779053, "uuid": "fd211e38-c1bc-4426-b09b-dc122d3625e6", "value": "T10AF47E61E2A14477C23B1E7DCE4F57A9AE6E7E003E24D1872DF81F8F8AB8193B505146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779053, "uuid": "47ab1ebb-2d27-4004-87af-2068cbb1e2fa", "value": "d5a5a85102968ed0997ce91809ca5aad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779053, "uuid": "bd8a9999-2345-4d9a-a3f2-b2ba29af77b1", "value": "12288:wTDxfHlE1XHBC/qo3R7HaZRZEBTV3bXCRfwUCm0gRS+:w3RFIHBCN3hHWeBTUFcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779053, "uuid": "0b989e1e-87c1-464e-91ac-81bea1b94bfe", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779053, "uuid": "326d30ce-1984-4b71-ad3c-95b0fe49a985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779053, "uuid": "cec12409-f7cf-4ca8-a76a-b95b3a5510bd", "value": "8877c304368ff62890dd1658c18c5559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b3d66c-4d0a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637746596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637746596, "uuid": "93df18e2-93a8-4141-8b84-5360acf7f4e7", "comment": "Malware payload (Formbook)", "value": "4155fc08fb94fc8a7fa3dbfb591631d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637746596, "uuid": "de275b3a-0a7c-4528-812c-124c5a7a28ec", "comment": "Malware payload (Formbook)", "value": "69c5ad156325c703a6754e1bb89b3d764d5015c9ad68aef86c2284e4b3a132e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637746596, "uuid": "6c22e885-4e9d-4edc-b8f8-cce253026f5f", "comment": "Malware payload (Formbook)", "value": "e54cd97704ea0ab32b4fac35c321f34029d2a26f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637746596, "uuid": "1dac7eb5-21be-448a-9393-283da43bda4a", "comment": "Malware payload (Formbook)", "value": "dfddf55b2f1cd0ab99d4189230c960cbdd6695e8b4c11cc61e61d093cdc8b42f7ea04e90e95127c86fc3687086d2afd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637746596, "uuid": "475217a0-7d5c-44fe-8100-274cc68c1e47", "value": "T11F642367B4E44937F5A3083A05BEF3F7D33D9E0500926F676B281FA93F551824A229D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637746596, "uuid": "c3cd0649-4cf7-4afd-a015-d6c56c365206", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637746596, "uuid": "b9661ec9-3e98-4521-8fe6-5e93d1d207f9", "value": "6144:rGiMgggcaNtN/+SYwBeXwkkMGXy2CMqkmB65+ZJXH5T5sZQ4N1n:ANQt4SYwBeAkkMGicqJBY+fZaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637746596, "uuid": "2285681a-cbe0-4b23-8a1a-5cb2ab89bd09", "value": 319069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637746596, "uuid": "1f036f3e-02b1-476c-b203-14480f6039c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637746596, "uuid": "a6b7b5a9-8638-4ca0-a58a-8665cc8d3027", "value": "2311202110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf72a831-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637763660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763660, "uuid": "c6b27488-e607-4298-8c7a-6675abf1a04a", "comment": "Malware payload (Dridex)", "value": "5b3a5c210da6c92ad1b28c057fb33808", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763660, "uuid": "15992a77-1c93-42c0-adca-08fa26a26ee4", "comment": "Malware payload (Dridex)", "value": "69fe1bc03e4fc0a7c9ca0466cb3cc352c7446b27a4ddb466ba93aeae4fbac7df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763660, "uuid": "78e5c134-0993-4d43-80df-b2ae4dfebe0e", "comment": "Malware payload (Dridex)", "value": "922822e5c237a2c3006b2caea28936d5d9382943", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763660, "uuid": "30be77ed-4b81-4da2-a84b-2b129e3b5c47", "comment": "Malware payload (Dridex)", "value": "17ce0922a3627a30c8f00080f4fbca6349832e34bac8b52f0d7143867bcbac332476bee4457d09614cf8e9ab1d1e00cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763660, "uuid": "96f616a8-ad93-406e-aef6-4cbeff70c515", "value": "T17073F1FEC544F01AD3118A7ECB7E4CE192154593BD652BDB2C9AF6182DEB2810BDC02A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763660, "uuid": "e156e34d-280d-475b-a49f-1608640c654a", "value": "1536:UWpPuALLImemeKHqeK7YncyUojd+8x4vgogK5R9YSKpfgdWIHmd:VI80XKUYMQd+8x4YofbyfgdWIHmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763660, "uuid": "1f914c02-819d-44b4-9bdd-5093399e11c4", "value": 77958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763660, "uuid": "a21864a6-b8e0-468a-bc3f-7ead146e9681", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763660, "uuid": "c07963b3-1f33-4c3c-9c2c-c4fefab12e52", "value": "Offer-04563360.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04eec967-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744449, "uuid": "cb4d2c39-5d46-4563-aaae-6eceab5a34fa", "comment": "Malware payload", "value": "4b94edf65201f74b1ded1fb44d794bbf", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744449, "uuid": "e49eedfc-fb72-4e73-a2c1-b9cbd1fa4aa3", "comment": "Malware payload", "value": "6a29703270ca150319af2439501cea3a4403aae736f785ec69d858996f63224f", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744449, "uuid": "7361384b-62ea-4854-bb73-773c78463157", "comment": "Malware payload", "value": "b9754865f300617897efc8876a8f1081dbc5a97a", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744449, "uuid": "cf9c30bb-95d5-4278-9016-ee4bbd3d0a83", "comment": "Malware payload", "value": "bdefad6d5ef1ee063d209fee3484e142fdd09f78a71428cd617f727f59b7261a043d0d5f6dca4d3ad2798522aea2c264", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744449, "uuid": "b8da78bf-6c06-4b91-9ce8-3f16c9f50ce2", "value": "T16CB5330C1376BCFDF85E422937634ED0C2B9A1E5F5426092926848A85D3F5BE13EF972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744449, "uuid": "f55d781c-d7e2-46ed-beca-4be7cdb781e5", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcW:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744449, "uuid": "1feaa1f0-fe6a-495b-9433-b5cec566c3f1", "value": 2383872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744449, "uuid": "75059e79-1d7f-42b5-b3eb-5c2e88deeb7e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744449, "uuid": "6d6351e1-2ac8-4d33-9cb5-1e71dfa9dc2b", "value": "6a29703270ca150319af2439501cea3a4403aae736f785ec69d858996f63224f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5cf826-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637780380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780380, "uuid": "e71b967b-7206-481f-b455-8d7b3a50b6fa", "comment": "Malware payload (DanaBot)", "value": "88d08c21c5d83322c13e667c8bbd3e0d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780380, "uuid": "f8a80fc1-5ec1-4b19-a576-75e3e4e22b8b", "comment": "Malware payload (DanaBot)", "value": "6aaff9cb90de5b64132a3e222fc0a28850ec2f257c4bb82c2f3831d8a8c9e96f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780380, "uuid": "5ac2a76d-94eb-4b98-8a82-f21857ab3fef", "comment": "Malware payload (DanaBot)", "value": "f916ca2292c77e98d61fc93321d4b27bcc2b0a5b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780380, "uuid": "671959e3-9aa7-4793-8c94-0d181e9722c9", "comment": "Malware payload (DanaBot)", "value": "26424bbfbe9bc72a77c276faf51bd88da1dcb7c0e33d4ae741d7ac21df8cdafec95ee969be4a3c8084362d623ecbc55c", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780380, "uuid": "4f2f123b-ae10-4625-83be-172911197dde", "value": "T17F958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780380, "uuid": "46475fda-380d-437b-8e7b-d4dfc4235ef0", "value": "e134379b53b1ab3fd17dd8d17aa88143", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780380, "uuid": "631743e9-ad05-4f4e-a3c7-306cb26f0654", "value": "49152:RQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BBe8qfn8+nFFQCxEsJwKQ9:RfaNQh+NUABO/c0Y9AdG8qf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780380, "uuid": "78f6c340-da3f-4135-9a38-e4ea09f46383", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780380, "uuid": "ff104228-40a1-4ee2-bda2-2829b8cf33cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780380, "uuid": "1923f8e6-7ad6-4ae4-b273-086e29082bc9", "value": "88d08c21c5d83322c13e667c8bbd3e0d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7eb1d7-4cc6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637717725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637717725, "uuid": "d870cf4e-28da-4ea6-9821-1e405907b5d0", "comment": "Malware payload (RedLineStealer)", "value": "5bb9ac32655956f1924110c7c9c7adc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637717725, "uuid": "7a77851f-19c2-48ff-801f-b2a75e69e84b", "comment": "Malware payload (RedLineStealer)", "value": "6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637717725, "uuid": "47a5a5cf-1ee5-4301-8ec5-ad96f7d164f8", "comment": "Malware payload (RedLineStealer)", "value": "922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637717725, "uuid": "827ff6d7-0393-4339-be0a-b57267fe067b", "comment": "Malware payload (RedLineStealer)", "value": "edc4197d40bd8e2a332f6974e9668f796038f300f6d92398dda71f63219ce2919b2a083651b71d7ee71c3c5147b736b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637717725, "uuid": "e24b4809-6bca-47fa-b402-0f683e9e0bb9", "value": "T1E865333277667F04C749013162D9F9B8AA3FA302E5B980EEE366C5D082AC25437DD5B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637717725, "uuid": "566a1846-9f1e-4421-aa1d-eaeff4033cd0", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637717725, "uuid": "21e1d5ab-801f-459e-a9f9-5e1a6738ca57", "value": "24576:UKazsxLWrhR5FT7tH11d9Cazw4WoEwC+ZEhQ5lZFpXEAkEaHNYK3OabV8NC:U1zGirdH1zIExRi1haBFNafbV84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637717725, "uuid": "9b80444a-bf21-4208-a257-6d905fa4df81", "value": 1488976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637717725, "uuid": "24fec216-8a4b-4061-aace-b77bfb5ae136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637717725, "uuid": "fbf178da-7e0a-43cb-bbc7-b5d0c750d6f2", "value": "5bb9ac32655956f1924110c7c9c7adc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b25392-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637772663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772663, "uuid": "ef8f5a8d-ba87-4ac0-8fd2-95fe85649e8c", "comment": "Malware payload (Formbook)", "value": "271ebb03b0806c3cf915235ad38aac00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772663, "uuid": "8cf6b673-3911-4b8a-8a1c-4cabb81cc5af", "comment": "Malware payload (Formbook)", "value": "6b88b59aec1fb94d80d8f8a2de07ce4cc13503492cf620f1d1b7ca0f812873ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772663, "uuid": "090d151d-012e-48c0-a9f9-e7b234b04394", "comment": "Malware payload (Formbook)", "value": "aa1f730cc4afade9dbb32bd8bae4609973de44de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772663, "uuid": "3316ddc7-b018-4c76-8112-303232d1c5a0", "comment": "Malware payload (Formbook)", "value": "28d6f47776abe13ee85417d9d9414fe4d016cf2c0b1394047ddc1f8b0ea17f9289b093124da23560a01429240ee3fa2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772663, "uuid": "cd9876f5-fce7-4530-b86a-44405497720d", "value": "T18BC40251338CA783C8794BF50C72A1D113B2A6176A24EA1DADC922CE1D32B155B27FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772663, "uuid": "45f5da78-ab28-4513-958a-e036cbb6abea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772663, "uuid": "dfad3fe8-b19e-4a9c-9c26-df0a1a39cc46", "value": "12288:VtD001/n0PtE3yS9/Eo9rM2qdx4rn/0c:VC0V4FS1bhMddx+/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772663, "uuid": "fe0bd9cf-0013-4a89-b478-7f336e99cf84", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772663, "uuid": "6bbbe074-6b04-4ed0-a6f0-48c4e256e490", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772663, "uuid": "577ea604-0a59-418b-8f19-858030e9685d", "value": "New Order PO-2087441006_NOVEMBER REF 9980488.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab24692a-4d32-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637764055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764055, "uuid": "da5e07f4-30fd-4cd3-be71-386cb43f046a", "comment": "Malware payload (AveMariaRAT)", "value": "622a125ee1469b4d9e35db04093d4e26", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764055, "uuid": "99964ee9-ad09-4945-95c0-ecd76dee8393", "comment": "Malware payload (AveMariaRAT)", "value": "6b89dd90bec4dabfc8b15b72351e8fae64e3e1e3ddfe927646d196e950328c3b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764055, "uuid": "9a893431-8d86-4071-831b-231c4348707b", "comment": "Malware payload (AveMariaRAT)", "value": "801c58a3b1c2f81c7e19adeea6a883a8251061aa", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764055, "uuid": "7197fc79-f49a-44fb-b2ab-12199fbd0ff0", "comment": "Malware payload (AveMariaRAT)", "value": "36695e683ca2e04ad44b8c36e7849843fb54d7e28ae256d926bc31400fc7b122bc1a0aa38578500b0339815138ae6a68", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764055, "uuid": "21d1a2e5-c549-4911-b6d6-191d55e0e00d", "value": "T19D64230E73DF69B9C714A7C12BA61F56E6E0D3CEDE040A551DAC3EA49C85DCAD8C3920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764055, "uuid": "f4d9ace7-f795-4f19-bcba-80e6a4bbc9cf", "value": "6144:45fmsNAZyG4uvHFHbtcM/ug5yHM0i4m5Rpmdr7rdcekcGop6XqV4Fy:xZyGvHcMGg5yHM14XdrfdcocqV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764055, "uuid": "d0b94352-6986-44d4-bae2-bb04d373dc8e", "value": 335450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764055, "uuid": "a19410c3-ff99-4b48-ab21-8fd4ce5528d6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764055, "uuid": "44b7fd93-df82-4818-9f37-90fdc99eaee2", "value": "Purchase-Order433423.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af313797-4d32-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637764062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764062, "uuid": "af5911c5-c55d-483c-ad15-478834f6f407", "comment": "Malware payload (AveMariaRAT)", "value": "9fbe7d19dc03440a3e40948a2c932836", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764062, "uuid": "047bf508-7caf-48cd-aae3-f176864d3086", "comment": "Malware payload (AveMariaRAT)", "value": "6c16bc6d5630dd8347293d909a7c675ccb36b21371c67d7d74992423b9e2390d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764062, "uuid": "7f914e1a-f6b0-404c-b863-b20f1d9557b8", "comment": "Malware payload (AveMariaRAT)", "value": "6c0d7f7e377e24434d7a65031a9084392cc7399c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764062, "uuid": "6e326451-7f3d-4445-abba-12c26ddd43d4", "comment": "Malware payload (AveMariaRAT)", "value": "e9315a64d585265944534bae3ce592c5eabc4e8492d808b1e554c3e0d52da3dae33e7c3eaae5c73baa0ef89b8650c663", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764062, "uuid": "b6dd4ce0-643b-430a-836d-b0007d3a8e30", "value": "T15294D0E3B25416A6C8BE8AB14835195003737E1F5994D31EA8CCB29E1DB3B620763F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764062, "uuid": "2a57c5e0-a494-4084-bfde-d3dca3c0dbb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764062, "uuid": "13fef906-824e-47ee-8f24-fd234f2b9e76", "value": "6144:TMjnVRHSWNbR6wDf5UcydK5lRLV2/tbUbbk0YA67QOnd4EiViHJv9:TenmWNbwmfuwLYUkwOQo6Vev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764062, "uuid": "88144304-4689-4d2f-8187-eae9b6169457", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764062, "uuid": "29b963a2-0326-4491-92e2-e1e2f7c3b61c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764062, "uuid": "993a45ec-b96c-409b-b763-63375b988c40", "value": "Purchase-Order433423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71a8537-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637765015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765015, "uuid": "dcbe169e-44dc-493e-81e0-d6f83d3d1984", "comment": "Malware payload (Formbook)", "value": "f8e0a31f592449d87fae8e9b76fac8d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765015, "uuid": "24fb6be8-652f-44b3-974e-84ce5ee3cd02", "comment": "Malware payload (Formbook)", "value": "6c77bf1abcd2822284197e71fe278ff2ff98fd98075e373500b29521f91e515f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765015, "uuid": "62ed3d6e-175d-4ec1-9523-bb5516454bcc", "comment": "Malware payload (Formbook)", "value": "5255ffa15f73e584f7d0a72538b919d8294e1bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765015, "uuid": "895a2750-3350-4bb8-bdfb-d5d0c38ae837", "comment": "Malware payload (Formbook)", "value": "24949496497c953a6d8af67f31fc468b1c365f90a04d7cc45e5a78e11d5f4f66191d48df0e15feb66d632cef21b495d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765015, "uuid": "8e058f3a-08bd-42a1-9d59-be084be280fb", "value": "T17BC4019933A9A793DC395FF10D3290C013B271197815EA2E6CC971CE2E32B465726BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765015, "uuid": "44703af6-b15a-4d72-92c2-e24b5d86cbdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765015, "uuid": "847a8d17-fa3d-4733-a063-b57f6e57b345", "value": "12288:WtD00KzIrw+KEV2qV5gZH6Nr11Jhi2eDbY5Cz:WC0ErZ9Kt8DbY5Cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637765015, "uuid": "93b73b41-b881-483a-8e3c-3c441a4d9257", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637765015, "uuid": "7e724b3e-82f7-47ee-9eec-640ee4f69372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765015, "uuid": "645d22dd-0afa-4593-b0eb-94097f7b400c", "value": "sample photo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457a64db-4d53-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637778058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778058, "uuid": "c950e744-6a9a-4feb-a5ae-7b7a8cd0bfbe", "comment": "Malware payload", "value": "3d6252d037cd3e30a4d97eadb9d3130e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778058, "uuid": "400a9e9f-75cc-4afd-bbf4-8d71911dd51b", "comment": "Malware payload", "value": "6df7d89acbd338a4bfe1935484eb346eb9238828f247de4be33d4c80370e90fc", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778058, "uuid": "b3009b74-8ac7-4ab5-94b6-23d141db1c8b", "comment": "Malware payload", "value": "9c114500a3a22c0727e77e010845e1f0549f727d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778058, "uuid": "276c17fa-d976-4193-b470-11dbcdb90ab7", "comment": "Malware payload", "value": "2456bc12aa2baf3f6901908d89586f1b8244995c2f0bf06ace8c0de4ff9f6ddecd36a27be8c9ba8c177b54d14ead5bf8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778058, "uuid": "907480d4-d9a5-4ad9-92e2-6ccece3d4aa2", "value": "T125A10C7F15F1F93583A5D693CAA93E4C6DCA8B2FD21C74DF6A98240D0A1D1C088C69DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778058, "uuid": "ff7ee7ab-1029-4741-b08f-6a0fba884dba", "value": "96:UXZtsxeY/Z7R6d23YPsrILRpc+mTwgbfb+aDW/Cd3pNy:UbsxeY/Z7R6d23YGGpc+mTLQCd5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778058, "uuid": "5d757122-2eea-4bc3-ab76-339eede1a4a7", "value": 5037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778058, "uuid": "17c5be19-5b12-4487-a4f5-34975026b8b4", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778058, "uuid": "fca12c83-1787-441e-8198-87d281c625fa", "value": "XgQXeAWeoOU.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12182896-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637749625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749625, "uuid": "cd0d236f-429d-443b-99d2-327d04f559f9", "comment": "Malware payload", "value": "df4f6c102357d0d0ee99914eb3e91ac5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749625, "uuid": "4c2da2e3-3457-41b9-bf64-c569813303b0", "comment": "Malware payload", "value": "6e997cefe0ae777fe44ac758680e07f62fd3ea89a85313628dd8b6a59f1ce13c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749625, "uuid": "1c268a6a-b2f4-48a2-9d68-3ab3291b6fd0", "comment": "Malware payload", "value": "ad5ce28dbdc9ca72f4ef710df19f21457ff4be54", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749625, "uuid": "88561f94-324a-4b12-8f0d-3a841f49aa91", "comment": "Malware payload", "value": "a270ced10e3adac0b7bad4079a3283189d8e851a757d23d1e803204012c6071da4613fdcfef1edc83c26586cda7a7969", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749625, "uuid": "71b3e36a-c283-4a64-8fb1-9a4267d67d03", "value": "T12C228C38D611FC1FD12101BEE059C1B9E60911B7EA21B92E2194726E47912C36BDFB7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749625, "uuid": "ee027274-8554-4fdd-bf40-04bc9ca4351b", "value": "192:ScIMmtPvcv8EMG/bCcCZO5Ol+CVWBXbG23wEZ:SPX88E7xAO5OHkqqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749625, "uuid": "8827acc7-f35f-42e9-a24a-db90f30982da", "value": 10339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749625, "uuid": "e5f754f6-0b96-4e0a-9153-a0979a02ff46", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749625, "uuid": "901532ad-5678-4f1c-a22b-0717d5cb2507", "value": "INVOICE - FIRST 2 CONTAINERS 1110.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d158db-4d20-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637756322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756322, "uuid": "c0ae1008-fee5-4247-9dd7-7b1a4edb5e46", "comment": "Malware payload", "value": "8a4cf899ce66a577228da0c737e1c21f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756322, "uuid": "656c8284-fc0b-4430-8f11-5ecfefb5fd6f", "comment": "Malware payload", "value": "6ec7aa60afcb5b409e55f0a47ff4ba273f1c9e28f7bd5c9f32b1d749ccad0719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756322, "uuid": "f9a36d32-11df-4128-9da6-0ef70dbef805", "comment": "Malware payload", "value": "8c44d167aee396e6beaa4a4fbe93e6022d204b05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756322, "uuid": "5619194b-e73f-4bbb-8ed9-2393b20751aa", "comment": "Malware payload", "value": "2726dd5178e1eb803d518176e5c020b30b258cd1eba85685621de0af1332e30c731e404aa44d7580fbf49166a5144e9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756322, "uuid": "a5318ef0-60ac-45e4-acfa-bdc81d0894ed", "value": "T192C5338644055579F8C53DB0423DB8E05B47349B4C9AB2921CABCACDA9B7ED3E3E160F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756322, "uuid": "68544917-6995-4060-afd0-ea75ea4ab9e7", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756322, "uuid": "f3fd242f-dbb8-48b2-83a0-37ec1f08514e", "value": "49152:wOA+peSvcvoeq9YRshho3lbeE3mArXRheDtbHxUi6Ph0Tj/mgmykBHTQ1maf4L/C:pr9cvo9Yqno3lbe8mArXRheDtbHxN6PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756322, "uuid": "692a5a7b-0951-463d-b430-dff979b36255", "value": 2685952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756322, "uuid": "cbe3c417-f815-4ef4-9660-5b6fc82913e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756322, "uuid": "27d9507b-1ad1-4d86-995e-01b310fe1576", "value": "6ec7aa60afcb5b409e55f0a47ff4ba273f1c9e28f7bd5c9f32b1d749ccad0719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403b03f7-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637778908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778908, "uuid": "62743b49-4958-4bfd-973c-a21f31bdf009", "comment": "Malware payload (Vjw0rm)", "value": "5578addeaf9926e7aa9edd19eec66b4d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778908, "uuid": "38c647f4-babb-4bbc-aee4-e346fdbe0c7b", "comment": "Malware payload (Vjw0rm)", "value": "6ecdd18eb432df3f754e32c723ff684984e6a33fcfa7731723d9d99481b83d41", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778908, "uuid": "161353ed-5c46-413f-9a67-f44443ccd7dc", "comment": "Malware payload (Vjw0rm)", "value": "279c6bbc6b837b4998d1ad05374f5baaab401177", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778908, "uuid": "2aa68555-61cd-41eb-9af7-f6e8b43f21fa", "comment": "Malware payload (Vjw0rm)", "value": "40dc2cdbbd1f8bc835f3c98fc21291f274adcb811986d4eb6e3b007a6dc2ad673cb697c79136b7e6ab0073ad8d742767", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778908, "uuid": "adb02d1b-4f17-479c-9a5f-3bf4a5fb9625", "value": "T18781109C2C4BC63C57D23B8B802ED148CDF548B47E28D2B6148CDAC5360E97987B19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778908, "uuid": "a56f2baa-1bb3-409f-9442-ed3fe111bd1d", "value": "96:SABNo5DRk2c24ZRMHXE6/BI0+Ys+fJGTLDdQqR7bJyKhMOS4UK:zSa2c24ZRMlBIvYs+fJGT3fRfRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778908, "uuid": "bc4eb01f-b173-4aa1-977d-d5ab7114ad2c", "value": 3885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778908, "uuid": "6f10e210-aaae-41db-be47-007561361cb7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778908, "uuid": "992df3f2-915e-428f-b4c6-dcaee780ef8f", "value": "Bill.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bd4968-4d6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637788016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788016, "uuid": "07cbafeb-0157-4511-93e9-8ae98e6713eb", "comment": "Malware payload (Mirai)", "value": "90280b7ab5ee47b189e2e68de01cdc55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788016, "uuid": "1175164e-66ad-48b7-a41f-79f1b07853d6", "comment": "Malware payload (Mirai)", "value": "6f026fa978d8dc7383f31bbf96091ebd2dcd496c9a400980cd9a467245f57d65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788016, "uuid": "4990d92d-4968-4dff-8a82-704139b835b7", "comment": "Malware payload (Mirai)", "value": "c22b33a29e1c7b72d4f7e01cf15ef06e1ab236bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788016, "uuid": "a188fa8e-fc27-4413-9910-4b320ff392dc", "comment": "Malware payload (Mirai)", "value": "6fc2af5aa63e003ffbce427ce0fce92c4f1081a61079bff76fa6e67be0d6a6276a4b102dca5ba524b08eec5f3b2581fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788016, "uuid": "93ac4edc-135b-40c6-9658-a27c3e378a05", "value": "T1FB534C0232680F47D1961AF0253F17F083FEE96024F4B689664FDB5A8635E37158AFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788016, "uuid": "c00b5f2e-d5dc-4b0c-b499-d5d3cddcc4ce", "value": "768:pPuER2OpK3seRSqjBs0kvP/GzIMg+HWEt+mJLYzDQtqgCyQuwz3V5Y6QpALeOZy3:BuEF48eSnNMg+2EiDHgu5uALeOAJfXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637788016, "uuid": "c3804ea6-abac-4acb-8cc3-007b06bc6405", "value": 66660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637788016, "uuid": "42d762c1-e73b-4643-8e46-c9e293e978cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788016, "uuid": "1847976a-387b-47c0-8dbe-39e041a76580", "value": "90280b7ab5ee47b189e2e68de01cdc55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33b0eca-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774484, "uuid": "ef3fc1c7-b2f2-40a7-af93-572fa9ceace6", "comment": "Malware payload (SnakeKeylogger)", "value": "37b80488301f8a155f7f3d152d29ab25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774484, "uuid": "ee008ce0-d148-4bfb-8dc4-8bbbeb87b4b2", "comment": "Malware payload (SnakeKeylogger)", "value": "701beaf4e0bf3aaa5add2a608ba2027fbbc39051198b1b6891f62db7a23164c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774484, "uuid": "1686cbb2-41ef-4d36-a481-3d30a53fbc7d", "comment": "Malware payload (SnakeKeylogger)", "value": "e91c7bb05a34cfa388b53b43d55d978023639bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774484, "uuid": "334c2ac7-af05-4a41-8c71-4e24d619c2e7", "comment": "Malware payload (SnakeKeylogger)", "value": "b6aba5efe31585101a9387266d27fd43ce880126738c11018f91fdf45f85ab741343cef59be2ca6d6b2733b56bf565e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774484, "uuid": "02326532-f420-4203-8e5a-daa4ee992cf2", "value": "T17C74F120369423BBCAFA0EFD0849634413B791597601D3DE5C8E565E2D92FAE4F123E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774484, "uuid": "ea2716ec-56a3-46dc-887a-c9c573dd4ff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774484, "uuid": "b8b202fd-ef4b-4e65-99f9-1d03f6cc4ddf", "value": "6144:UMWRmHppzSIttXjvaS0hUxigyhIINDvntbBeIW0GIZc4PnmSMyhB92xaAdi:a8HppzSI7uS2LqUvnt1eGGQ9+SMGLKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774484, "uuid": "7b275c9d-4c49-4bd6-b061-81a3c2fbefea", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774484, "uuid": "5772c64a-482f-4ea4-b88c-861b2f4c5c98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774484, "uuid": "b8f28ead-54c0-4e82-8fde-7c1f694330a7", "value": "ZiraatBankasi-20212411.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f3b6eb-4d3e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637769328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769328, "uuid": "9b5939ca-ad1e-4143-bd23-0b821402672d", "comment": "Malware payload", "value": "a6d0890c962e0ddf6d49dbfaea5ad45d", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769328, "uuid": "e9637ce3-e268-4b32-aa4a-e37c6fb29760", "comment": "Malware payload", "value": "70b11fd6e051fe8922d7f25b5f748a2ce31de5b73bbc79800caade32fa913691", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769328, "uuid": "2099c1a4-8e9c-4902-b684-925686d39104", "comment": "Malware payload", "value": "d555f4e3866b1eaa50793905b70006dffc66e1e3", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769328, "uuid": "d682768b-ac1a-40a9-9a6d-7c7b6031822d", "comment": "Malware payload", "value": "bc024be06f7bc943c532539470cb06e7364e58e175c13a6df665162829cca90eae28db5606469d8710628a36f8eefa19", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769328, "uuid": "a51d5ef0-e305-49d5-9a79-f5918c0e54ce", "value": "T1B59594E0222A3852E137D15AB11B7145AC10F73416C2FB9DE27FC6B5222B1D78F9A763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769328, "uuid": "5ac6550a-0b39-4a27-8f32-df1ed8d7af4a", "value": "6144:4lqB96bQGrJ7AwLYhURlsbcKlcSTIZUgRgg0Y7QaRAnscVYrLUipxAAyaseJkOnK:rwzpUWRSbcO1An0Y7uFQpe+zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637769328, "uuid": "3ab431cf-d0f6-4148-9a6f-91e73251998f", "value": 1893933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637769328, "uuid": "1a029edc-e0b2-4fba-b8ce-7b1ff518feed", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769328, "uuid": "ada82679-9ceb-4a5a-a0e9-8b3c12fb4b6e", "value": "70b11fd6e051fe8922d7f25b5f748a2ce31de5b73bbc79800caade32fa91691.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f58946-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744451, "uuid": "c66f55ad-ee04-49c6-88db-cb363f587cfb", "comment": "Malware payload", "value": "424fa2872ae9c3bd7d66cd5ac07aec1a", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744451, "uuid": "e8259504-35b6-463d-af0c-2f11972872be", "comment": "Malware payload", "value": "721b5b9c6060b5c2d4845a101e0d3c1819da4431e27a2678faa494827cea3966", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744451, "uuid": "198eade6-9432-4e52-8358-a31a8dfd99a2", "comment": "Malware payload", "value": "942d7c5f01c420a1591fc188fcfb7602982257b6", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744451, "uuid": "dbca3342-17af-4e23-9603-f5374d737d3d", "comment": "Malware payload", "value": "9909610d3e0687d6d6ebced08259b66d22e3b5bcfd49b1a4962e3410f76401148c00ca673752e3a785eafe88596a1c69", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744451, "uuid": "5e84594c-7411-495b-978b-d1d53dfa4920", "value": "T15EB5330C1376B8FDF85E022937634ED0C6F9A1E1F5426092926848A85D3F5BE13EF972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744451, "uuid": "3a63eea6-abc9-4265-97b4-7a9fa559b986", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprX:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744451, "uuid": "14c29fa5-2786-41b4-a304-952b8a5106c3", "value": 2375680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744451, "uuid": "13acd60d-a60f-4227-ad3d-3dfd0566e707", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744451, "uuid": "d9c14df7-25f7-480d-b632-9eed1e011e17", "value": "721b5b9c6060b5c2d4845a101e0d3c1819da4431e27a2678faa494827cea3966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d117ea73-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637779151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779151, "uuid": "8fca942d-6067-4214-adde-fece612b218f", "comment": "Malware payload (Formbook)", "value": "e18afec0067430f2bd26c62fbef10a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779151, "uuid": "8da336c4-cdd0-457a-88de-fa745bf5c032", "comment": "Malware payload (Formbook)", "value": "7343dc198d87dda35588f5efe8fb5ba871a2ab041df2349625377a91399465ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779151, "uuid": "e3f7a31a-208e-4e8c-9ddb-a4ab954a3acc", "comment": "Malware payload (Formbook)", "value": "29f875fed77f82a3c50b888ad5595e12ec39ba81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779151, "uuid": "9e06d875-c2b0-4da2-a76e-4a741bbdfc38", "comment": "Malware payload (Formbook)", "value": "9f8c2447c2a21165b88be048445a0219f3e6407479e1a3a719cb6262702bd7d47ed38672ed914e72de9a3f0f74d5a41e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779151, "uuid": "41514bf8-4625-4d9f-b0c3-385726b283df", "value": "T1D564220FBAC04DB7E6F622300E37F67AEAF6814E05115D6B0BF0DE570AB05672257295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779151, "uuid": "03e424f8-7244-4877-a2f0-3b68e3fe8cd3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779151, "uuid": "a0e4ce70-4590-474e-b8e3-f9a834f0e91f", "value": "6144:rGiUaS7OejFAWQWW6xQbSKbePQB6r3DCRKT6siwTZguXSalVz:AF7rjmv5zbSKiYB6bDwKviiZguXSQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779151, "uuid": "afc807c6-ffc6-48bb-9b4e-8e608788e321", "value": 319951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779151, "uuid": "3501b0b1-6d29-4976-8cd7-85ea7ac769b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779151, "uuid": "56829ab9-2e7e-4079-85d6-86a0501d142e", "value": "e18afec0067430f2bd26c62fbef10a8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589b0623-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637749743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749743, "uuid": "d8b3dd4d-467b-4348-b330-bd51a839970d", "comment": "Malware payload (AgentTesla)", "value": "d40b820d57719264d92b6a56681f904d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749743, "uuid": "d77fd048-434f-43dd-995d-76b3d07a7003", "comment": "Malware payload (AgentTesla)", "value": "73623ad7164d608ee6f4bd140c0dbd141025ee7dee3c180a56ff011229f702e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749743, "uuid": "d1f59e89-01d8-43c8-b7f0-a715b35d0b4d", "comment": "Malware payload (AgentTesla)", "value": "298e335a8777569cd51ac3e3219c2329affcb70a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749743, "uuid": "31bc977d-68a1-41d8-a42c-360129ac766f", "comment": "Malware payload (AgentTesla)", "value": "086e62fff5fa9a96ca3a070b1e5579083059ce45d48e077d08192825a5ceb61f14c3321d07141b44cda8cd3a5e6f7e32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749743, "uuid": "f1c48df6-e224-4427-bbaf-544b5aad996c", "value": "T1DB54BE0033E08B67E1B2767C44A102415B75FCA79932C60EBFF8A4690E5AF845E75B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749743, "uuid": "1e18078b-7fbb-4ce1-b74a-f4dc0b06f4fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749743, "uuid": "532a5972-4068-4243-9df5-ca51ec936b52", "value": "6144:FlRzPrb84NAME+sGFrRA11btW7+2gttn20FcTJt0OCokvsyU:FlRTH8sEnGFrup2iD20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749743, "uuid": "e69ebee7-8567-44df-8305-1a8a16742404", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749743, "uuid": "e93be5a5-b2c2-4c04-a1e4-d174c7306c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749743, "uuid": "4f13b7d7-a0c6-41ce-af76-25ad9adce317", "value": "All the Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9f9a3d-4d02-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637743494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743494, "uuid": "9e1839cd-3feb-4212-af4c-5605a64eeca6", "comment": "Malware payload (Loki)", "value": "1210268ccddfd7508f1ba98c9f7bcdf9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743494, "uuid": "0542a3c5-5a65-4dd4-a51b-a72220c27d5b", "comment": "Malware payload (Loki)", "value": "739900ab4481bbc312773ca30dc881f8683df949545309a8fd278ba75a59c33d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743494, "uuid": "056a9497-9a28-424d-a7d1-b89bda985ab7", "comment": "Malware payload (Loki)", "value": "51212706b802c13a3f1bff8703e870845a3da762", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743494, "uuid": "b670f100-cb50-4c3e-8400-8b0622a211ba", "comment": "Malware payload (Loki)", "value": "ce4a08658dd2d096abd3f54113c5f7ced3c0b2b51ff8acd9b424d4689f3b36c39a8e123aa44d22952aebf83b861733fa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743494, "uuid": "8d96b85b-841a-4651-aa4f-edb26707e805", "value": "T1713412A63F4C60D5F5E4957E19D55820DF48EE8ECEFADCE85032364F48700EA0A7199E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743494, "uuid": "a403b724-6e25-4dfb-a8c1-2578f7604b95", "value": "6144:PRkbSBvWPyA2SPhat1I5kH/62nghvLfqWNZJq2A1N7:PRAAvcP4t1IuHi8mT107", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743494, "uuid": "0db14a48-38e9-4dd5-a358-6f5ac6bad1ea", "value": 234584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743494, "uuid": "23325cb9-3bb1-4b52-b4cd-4eb50e0e7c0c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743494, "uuid": "1841783d-ef05-4487-9a56-8749513b3b64", "value": "Shipping Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13a07e2-4d4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637775662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775662, "uuid": "8afd5fa3-d1f6-4cab-a7ce-e1dbe36f2ac5", "comment": "Malware payload (Formbook)", "value": "c20469cfefcfff15d9a8d7309a0cc99d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775662, "uuid": "8f4b7be4-1728-4552-83a2-32691ab5d588", "comment": "Malware payload (Formbook)", "value": "740104c1a6789b2325d444f6ed8819357cd6509be6d84828b907beb1e8f7d6d6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775662, "uuid": "b2feb6ae-b0df-4e37-a686-46214c0b09ed", "comment": "Malware payload (Formbook)", "value": "b099ac273d0623b7cd4a8b7c27a74384f49acfcf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775662, "uuid": "bb5181b8-8303-4f3c-8441-50827407fa58", "comment": "Malware payload (Formbook)", "value": "759f0f72782ee2ebcbdeb58e42c696d3395a387a9baab0b60a041f6d842dbf508a111b455adebc23fddb8113ac1c7e5a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775662, "uuid": "bf421030-9a26-4ce9-95e7-8bf703372ec2", "value": "T13C62AA9CC46702888F45ABB81B2BAF84019C7A2DFB859933317C9B7527D2E7E401397C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775662, "uuid": "3c505445-514b-487e-a53d-497c1b8a6623", "value": "192:+S/1+Bybh7jK2NZhjI2MDcQVEBjQ+1CzWAIw8BSFQuptq5gU/ypCvsbq:71gT2Hhh4cQVQjQ+EzJIiF9ogkXvsbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775662, "uuid": "7b9ff373-2bee-4a95-8a5a-e3abff2c9dcd", "value": 15861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775662, "uuid": "6de58739-8013-4a6e-b864-608d249332c2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775662, "uuid": "2e58beb8-13a5-4844-bc05-1114ac98b92d", "value": "Payment Advice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af39b92f-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637780383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780383, "uuid": "84794d82-8352-4b40-bd5d-3a9fb9425fde", "comment": "Malware payload", "value": "38135a0c76ab13a722d2ebb2fb4b458c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780383, "uuid": "7a7bbb8b-5a60-42ae-85d5-4ba7d70b0a41", "comment": "Malware payload", "value": "750adca8e434c3d8cd88be58d28d842b862f6be645ab4b86fef5b6268da9d187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780383, "uuid": "0118469c-949a-434e-8a3c-24ca8d5b9b1e", "comment": "Malware payload", "value": "251c9bcf68edbb5c59b08347eeae01291a78d26d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780383, "uuid": "a20331cb-16ca-471a-90ee-4ead8845c8a5", "comment": "Malware payload", "value": "c8f9050af8b62a787db8e9d6fd47cda94001e87b486d85826deb74cbda211aa85c182e26ca4f35634fc30fe181ae6038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780383, "uuid": "4ee2a049-6920-45df-b975-f14426e36079", "value": "T102C4F10237AC4763F8AA377C549F001A0F7AE5969C32D7498F885CE93D463C43E4A66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780383, "uuid": "6de86fa0-7437-485f-af55-e7de3adddba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780383, "uuid": "75fbef22-2d08-4f2d-a61a-22f981f7e066", "value": "12288:/m16d+f/SU5PG3taNgCaCP7Vb0Xmj6Qj1Kd26m:egQnpNgCXxIX+ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780383, "uuid": "4a0d74d4-14e4-435d-8575-a2ad5dd0bf08", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780383, "uuid": "69e4340b-0246-4479-b839-6a322b5c05c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780383, "uuid": "d6b4ed8c-b76e-4910-ae6d-45c45b05eb5d", "value": "38135a0c76ab13a722d2ebb2fb4b458c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80e808c-4cfc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637740884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740884, "uuid": "f8170245-1b18-4ea2-bc94-ef75b2aaecbd", "comment": "Malware payload", "value": "7c25938ccb9c50cb9ee6bd08a95947e6", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740884, "uuid": "cf6d7b70-26c9-4ddc-a801-04e7513fe673", "comment": "Malware payload", "value": "76fe99189fa84e28dd346b1105da77c4dfd3f7f16478b05bfca4c13a75d9fd07", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740884, "uuid": "a6bed59a-e3a4-4770-bbb7-3b5113b31956", "comment": "Malware payload", "value": "3c760723ffbc72178ad543e2cd53ea85f8de71ff", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740884, "uuid": "11a01156-f57c-4616-b73e-c7fdfa84e59b", "comment": "Malware payload", "value": "a8a6eadc10a93075cf15672f4c753dda9e5ee8a23fe6adfb5fc939ae2f5e149e238cf314932caba9f4490ebc35c3cc07", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740884, "uuid": "71342c65-0f9f-4a54-9815-1cafa9bf640b", "value": "T10B75DF1176D6C537C06701702E2ADBBA9139BD700B32C5EBA3D85E2F6E316C16672F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740884, "uuid": "27673bb9-a3b5-46f3-a903-83f082ef5a8d", "value": "d6612a3ed6fd33f95566d0cb5aae2cc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740884, "uuid": "928e7331-5aa2-461a-ad33-1e64e6104efe", "value": "49152:YgUgbYXwB3FHjD5JPz1MbEUl8VlvfxA7vW/LL4Ni:YsYk5JPpYEkMAzWz8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740884, "uuid": "311bc44b-a7ba-49c5-aca6-44e3eac57ff2", "value": 1602048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740884, "uuid": "39dfeee4-992a-4a3a-813f-8dc49a580fea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740884, "uuid": "13332058-e71e-4116-880c-ca3d00779863", "value": "76fe99189fa84e28dd346b1105da77c4dfd3f7f16478b05bfca4c13a75d9fd07.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d41fd8b-4d15-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637751496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751496, "uuid": "56aa1f83-ee04-42a3-accf-179c8c9a9713", "comment": "Malware payload (Formbook)", "value": "443e4919f80df2efc79f883fc4e0d85c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751496, "uuid": "9cd7fc73-3b6e-428d-87a3-7eb4ec64829a", "comment": "Malware payload (Formbook)", "value": "778b43e9a8b8350b3940a9f59684f454e5a1761eaa38198430af89b968a2ce35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751496, "uuid": "ee82e293-abf8-4208-98a3-657cc778e593", "comment": "Malware payload (Formbook)", "value": "af00a5cd9760b841476403652388b5b04fa1e08c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751496, "uuid": "f59bab43-b52a-441c-bbce-8ea3713cb091", "comment": "Malware payload (Formbook)", "value": "8c49cec7361879e8387e5c6ca16b0197858adcb7ccd214d3d167046c8fd864d2a9ffd71b861f2eeef66a7a54a9ddb05e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751496, "uuid": "dc9fc1dc-9bcc-47e5-8417-fe2a65ee33e6", "value": "T13764120BFEC454ABC881817680BF1FE8D3BDD78052F89E0B0F981F926565B4A5D8917B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751496, "uuid": "49e6ec5f-eb74-43ce-8a9d-ac8c49b119dd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751496, "uuid": "46cbc43a-01f4-454f-9552-0d8cd81454e3", "value": "6144:rGi8EAJCSPSic6viRLsswmBelCBofK4vGz1O9nclFSzrQHzect:zAJRPS1NRLn+wBoisaWzozect", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637751496, "uuid": "61a49165-32e0-476c-825d-ab4f3d863415", "value": 316693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637751496, "uuid": "71e4967f-c292-4c53-b796-73713a18ed3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751496, "uuid": "a7d3691b-3e2d-4505-a92b-908dcae73765", "value": "New Order778880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0041c4c-4d57-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637779955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779955, "uuid": "04d6928c-3f0f-4c1e-918f-15e9b39344b3", "comment": "Malware payload (Formbook)", "value": "aeb444af4df3177f66d0d2c40cbd39a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779955, "uuid": "57340cdc-7c76-4e64-85c8-11bde514d6d8", "comment": "Malware payload (Formbook)", "value": "78bf20a97887ceb674ba6bbda37884a412be37dd320416d2222142c12f7de517", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779955, "uuid": "fc60f66a-45b0-40bb-a22d-d521ad0a636e", "comment": "Malware payload (Formbook)", "value": "0e992e11b574d3a20e75d2d40940c6a9fc20c381", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779955, "uuid": "4a573aed-beeb-42da-b840-49d4a36280b7", "comment": "Malware payload (Formbook)", "value": "6ee3e812894aed748e495b7dbe5991d7c9b65341dba734d1d55ea8e6bb78f9d0be6e2db4e0008718c061282bc030ea0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779955, "uuid": "2d3b79aa-be69-449f-898a-750925c55c92", "value": "T1A154120DF8E4AE77DA52287965B37A7EF7AB45581833871B07A01E7B69532E2C104383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779955, "uuid": "f7b2ba5d-b817-4a1c-a36e-135cd3b9180c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779955, "uuid": "66d61049-f6db-4484-94eb-7008eb611e52", "value": "6144:rGiVVmS6IWekrogid1rSj4vpE908MJc6WF68vDufg:hV8IIr+5MDufg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779955, "uuid": "c023a6ae-6c16-4e9b-8283-93b50ced5a1f", "value": 306049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779955, "uuid": "57f3d59d-d3f3-47a1-a04d-150f26c44114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779955, "uuid": "c5312bc8-0649-4a5b-9cd3-44d7b1d73ce6", "value": "aeb444af4df3177f66d0d2c40cbd39a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787e4275-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637779003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779003, "uuid": "4c84f990-a389-4122-a190-5d7e26891168", "comment": "Malware payload (Formbook)", "value": "c623852e03ff403e7702bffa387174c1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779003, "uuid": "a6b294d0-54f5-4d97-a1f6-d9b163935383", "comment": "Malware payload (Formbook)", "value": "79d3e390f7d102dfb3dd6840d95a54fe2dd26a5f90ab8d040be7024e6f9d53fc", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779003, "uuid": "0ca9e0a1-35d9-4943-95e5-082fb02d3141", "comment": "Malware payload (Formbook)", "value": "1d8989c0647617a908fb21ec1fadbbbc9970a004", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779003, "uuid": "3edddfe3-d7e6-49e3-b2e1-b6f0461fcc43", "comment": "Malware payload (Formbook)", "value": "edf43a85b2ba13f4884ec15174609cef8ad8127d2a94206896b4c7c1616ffb30c518a83f5262da63bba2c073ccda1b60", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779003, "uuid": "53b392d6-00bf-4f23-a28d-ae232fe36b06", "value": "T16C84012832A9A357CCBA4FF91C1025C82373A0563925CB5D6DC966CE1D63F274B22B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779003, "uuid": "f0bcdba7-5f20-425a-b7aa-04a4ddeb6ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779003, "uuid": "f3eccf68-db9c-434c-a815-5a632936a989", "value": "6144:USpvghAXVerSn8H0M7czR7sNgNq+uFgqFwUoXIOCFNPPGJs3x39R8sLNFkT:USBjler3UlqNZFnw31CX73x9R8sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779003, "uuid": "ba2127e8-bef2-4330-9a73-b64bcd96674d", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779003, "uuid": "8b43b3e6-3db2-4cef-a133-1247252a2cbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779003, "uuid": "71be49cb-d743-4a53-a4d6-552f7932f853", "value": "DHL - WAYBILL 44 7611 9546 - Joao Carlos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3556da-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637775866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775866, "uuid": "08b29a02-fd22-4f0c-b166-78f01d94c33c", "comment": "Malware payload (Formbook)", "value": "3edd9c068ce7b3ddaa02abe78c474ea0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775866, "uuid": "6cd18ccc-a804-42e1-9a00-eb12ce5e945a", "comment": "Malware payload (Formbook)", "value": "7a85175224c0e7892f707c8d6e2ee56fda961251cd7e7c98ebe3c6a14476e6d0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775866, "uuid": "aff610d4-b3b4-416d-ace0-73cca6ee324d", "comment": "Malware payload (Formbook)", "value": "36a9b806e2d7cb44bd8b745b4b0df2dc87fef075", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775866, "uuid": "78f423cb-ce08-44b3-8046-c477b40488a3", "comment": "Malware payload (Formbook)", "value": "80204aa9f976bb256c5c8694c0c9ea0adfe7f8cdb7fbd5ba67684a4d3c57506436d82c2d4900410ba5033c583fed2a6f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775866, "uuid": "e0c25207-971b-4726-9974-ea790da0a104", "value": "T11334124BF550CC67E5C3BB3605358886C912DDF620AF89FE5712785E18FE40A881FA7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775866, "uuid": "d2d7d21f-3dcb-4089-91eb-9fd57565a25e", "value": "6144:cTDz4Akt8Ves/3OGdL5abMkn3TZ9TYU+i4dfK1:cTP4Akvs/3bQbrZ984KC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775866, "uuid": "ba39039e-93ae-46e6-8837-01ff9ce3f0c5", "value": 234264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775866, "uuid": "653a3087-da3c-4c49-9f12-e6d9bbb91e3d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775866, "uuid": "239b562f-8b8b-42a5-87a7-b1ed6bfc7ff8", "value": "RFQ_PO-330758290144.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923e2db5-4d26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637758859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758859, "uuid": "02b121e9-3494-430a-8220-d5c7881653c5", "comment": "Malware payload (Mirai)", "value": "9f5b64b13a8d796ca451e10a53046526", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758859, "uuid": "4792e234-fb6a-4231-9d0a-2ce9457de8f7", "comment": "Malware payload (Mirai)", "value": "7b0dd3f3a069629028f86860dee1d8cde40496523886c3b86e841b9015e4ceeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758859, "uuid": "f4598352-e2c9-497e-bac9-77ca04cd603f", "comment": "Malware payload (Mirai)", "value": "fa42f72674335e2f8e0430cfd1e4b251b8066e59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758859, "uuid": "397cb215-f9dd-4894-b367-4808855f5b26", "comment": "Malware payload (Mirai)", "value": "d8d15d58fa693d644a1414eabcc51b5324f9c17a4e894a0ceb212db9421a07a8526d7ab08bce4d970843ad20f879430e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758859, "uuid": "34e0d217-cbdf-45c3-b251-818532c24ec0", "value": "T12E73A44E7E218FACFBA9C23457B79A21665823C633E1D586D1ACD3011E7024E741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758859, "uuid": "5db31e1b-0a79-4d52-967f-ee9426bb22f3", "value": "1536:U1UP2oD/+Uz7T7Sz983p0Flosu+rwqR9WneGMyo:S89D2UzH7SOp0FlosuRqPWiyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758859, "uuid": "db516ef2-79ae-4276-b96a-37bb2b34061e", "value": 76844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758859, "uuid": "9dce028e-2f7d-4f9d-a95f-f06bd208e48f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758859, "uuid": "483a6ad4-fed2-403b-8846-dbec4fe59362", "value": "9f5b64b13a8d796ca451e10a53046526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcf6ab7-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774445, "uuid": "988d676c-d44b-4c09-889e-1f4f8310e8ec", "comment": "Malware payload (SnakeKeylogger)", "value": "a8d9e216bb0f76e50fcaf9b0c0d814e6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774445, "uuid": "38cf6caf-d155-49f7-9093-bfba7b518120", "comment": "Malware payload (SnakeKeylogger)", "value": "7b41b1c214cb5106af76bdca051e86ad0dae21105daed384f86fd88b3dc7f727", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774445, "uuid": "56eeb730-4d06-4e21-9379-7578d1084f4e", "comment": "Malware payload (SnakeKeylogger)", "value": "95057a838d74d5606f5e667b5bf0f9964d8d7522", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774445, "uuid": "a1233831-6a7e-4575-8b98-0fb2d2d801d0", "comment": "Malware payload (SnakeKeylogger)", "value": "9dc4901def9c8ca567247fdb8f8fed1421c39ea6a6cbd0499b066a441173723868d991d20752005941aaababb48766a8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774445, "uuid": "b3d58725-f89a-4c47-bca3-840ea09a5765", "value": "T111C4F13D56285A1BCC79C6751CD108C3B5AC15A3F028DC9ABEDB132E16C765E33B922E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774445, "uuid": "be2482e2-87ea-4fb7-92cf-1809a4dff267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774445, "uuid": "68af9dd5-4e22-465e-9bea-8467eeb0b558", "value": "6144:Dp6Uxj/gsojaue4VIESQXeGYTizUC6iHIC3RIsra9IRBNJSnYtNCUbGc13qJHbC0:Dphxj/v0Fe4VIbHTL+o6nO9IzDDbQbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774445, "uuid": "bcb4c719-f593-4fcc-9b35-b0428d2239c7", "value": 564664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774445, "uuid": "f3aafa40-d8ca-42d7-9c99-76370d703dd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774445, "uuid": "b3f54ea9-e1a4-42cf-80b7-40806cdd88fa", "value": "PROPOSAL CATALOG.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63e2153-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637782596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782596, "uuid": "281326bf-4db7-45b6-9880-617359aca7b1", "comment": "Malware payload", "value": "ab6e2fae3a64a255d1d96e8532089e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782596, "uuid": "28868150-9435-4d3f-a4d6-b9a65be4cf6d", "comment": "Malware payload", "value": "7bcede232355855088286a518fbf494c74468fb399dbb6766583b80a7eae0f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782596, "uuid": "391bd82d-4cfb-4b54-8c2c-44a86aa46a95", "comment": "Malware payload", "value": "c55310ae348c633eb5027c54fe36e75fcb5f2ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782596, "uuid": "b28669df-ae3b-4c00-bc9e-948fad579df8", "comment": "Malware payload", "value": "62be4eb5ef63f8c789121efaeaf0702937b30877cfec9f9d6d6004b6ad73f90d4748a59670d382f162332dd25c4ec5c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782596, "uuid": "8b4843b1-0766-4f19-aaeb-e6c2c5eaea25", "value": "T193B3CD2D3443C760DE4624BBCBF7EA408F2214D187374A98AB58DAD0EB0D1727F567A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782596, "uuid": "5b9f8b16-b403-4c4c-b03c-638070f4e837", "value": "1536:Mv69BCKQt6dHAOob9rAWRGB5Zz/c+eLnpBkfk/ff:Mv6rFQt0nobXR4Zz/cHnpB5/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782596, "uuid": "500fbf96-001c-496d-861d-781462669dae", "value": 113625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782596, "uuid": "58271bcf-f447-4d2c-8ae5-eeb66bd3276f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782596, "uuid": "a05a53ec-6827-4541-8b88-b1f18201400d", "value": "ab6e2fae3a64a255d1d96e8532089e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c41ae6-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744452, "uuid": "b66a1af4-13b0-46db-a252-1d78d51bc4d1", "comment": "Malware payload", "value": "66c2482b475c2474c873875e0fe07773", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744452, "uuid": "b45f9bc8-0f80-4ec0-a17b-8e2a6c4a32a0", "comment": "Malware payload", "value": "7c3cf2cc42019415fcb901242a569d6ca2290b91edeabfd87b0d0b474dcdf430", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744452, "uuid": "a5769ae0-7647-4451-9044-d257f867ec18", "comment": "Malware payload", "value": "4584515affb736b11a604663ebce9505e857995c", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744452, "uuid": "81bf1ea8-9ae4-4807-b23e-939831de2ba1", "comment": "Malware payload", "value": "8739da1053d376e7ddd36c2198d5c328d1bcc2756870be6334dcb929b09d55ec9df29e441e412b3b9a21a9480df1d520", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744452, "uuid": "28316dda-5826-4240-badb-8a681ea9708f", "value": "T1E5B5330C037ABCFDF95E022927634ED1C5B9B1E1F5426192D26808A89D3F5BD13EF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744452, "uuid": "8b8c6e4e-de8a-40ba-871b-5c2ec362e34e", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lfprcq:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744452, "uuid": "ff00ed96-1372-4c41-bd04-e52f2a3ad01c", "value": 2404352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744452, "uuid": "6842f5de-443f-4dcc-aa26-eebb6a647229", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744452, "uuid": "a32f1c2a-b2e8-4207-ab2f-b85189b96be2", "value": "7c3cf2cc42019415fcb901242a569d6ca2290b91edeabfd87b0d0b474dcdf430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e759124e-4d02-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637743540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743540, "uuid": "27a86b55-cca7-48fc-a02b-1fb4b87a7ed7", "comment": "Malware payload (Loki)", "value": "3a68b643754fb635575001345370a6db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743540, "uuid": "5854ed0a-6628-4a34-a2e3-00bcbd7788d2", "comment": "Malware payload (Loki)", "value": "7c909771fccc47bcaeb55ea3e86fa1fae9e2f996afeb791ea41e9007b16c6d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743540, "uuid": "c212d23a-2c30-464e-b7b6-ba73e6121f9b", "comment": "Malware payload (Loki)", "value": "a63bad3d2ff92e4ff154ff8c88858cc28ee2b0db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743540, "uuid": "b23019cd-b25b-4c2f-90e9-0a935e3089d5", "comment": "Malware payload (Loki)", "value": "09d802a69f4bc3a01d3e62b9135b6976395b12ea0fedb37ed718b32e639079c6ed2f1330a117d27811d3b393917407a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743540, "uuid": "fc079d44-5eab-4060-8688-3cbf7eed1774", "value": "T1BA64F13132EA7363CCA64BF51C2025855372B1553915E36EDCCD52EF6E22F168B22BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743540, "uuid": "9fd35467-ca9a-4c1b-a35e-f49e025249a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743540, "uuid": "8fb65117-eec9-4634-904a-7b009a2d3e08", "value": "6144:imx7ueelLVeU6ZHb1/OUfjKufWoYFljBCo1+6:iiyRLVeBZH9RPOoYbBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743540, "uuid": "c16fe1b9-4463-4668-b57a-6797c8fc0527", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743540, "uuid": "d6ae44de-9601-4b79-9496-7b291bb20327", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743540, "uuid": "caa55605-52c7-403c-869b-267cd50fb21e", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc121974-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637779143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779143, "uuid": "35c55c92-166c-496c-a137-a3c726cba1c7", "comment": "Malware payload", "value": "a2737f741f060414e3ae578107e13a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779143, "uuid": "9087478c-50f5-46b9-9635-da3492e60234", "comment": "Malware payload", "value": "7e174bc2432736e3e536ea5c0988f2515c694eb43992606ba7ac1747314f18b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779143, "uuid": "65a58175-d234-41e3-bd41-3dae9e69edc5", "comment": "Malware payload", "value": "20dcb5bec87e93be4ad70f91cc84736e63fd7b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779143, "uuid": "b1d3e38e-02ef-4129-b359-49e6daaaf5e5", "comment": "Malware payload", "value": "4d75ecf5c7e48792d56127889a1ae7b34b088190b10ee2b55613f50fd98679f2dc25e64710598665a1dbd4184ede7340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779143, "uuid": "778d5c08-0e70-40f6-b013-ade5086a8ee2", "value": "T126245B72F180A537D1762B789C4F85EAA816BF251E1C38877BFD1E0C9F7D2907928096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779143, "uuid": "39cee74b-4d8f-44ef-89bc-b52716519344", "value": "6144:WC+SnQXILyVKk9FgWfMQGHrCIU/hPPULgZLMmQ3:qXIL69gWfTG2pMP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779143, "uuid": "2a77ee98-16f7-44b0-b004-e37a265de314", "value": 218306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779143, "uuid": "f079d954-f476-489a-a016-2371bc8a627c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779143, "uuid": "e9575a55-133b-41a0-9e59-3cd934449e52", "value": "a2737f741f060414e3ae578107e13a74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2498d89-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637763745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763745, "uuid": "6bfacb15-3ad0-40cc-b89c-0f8869d606ba", "comment": "Malware payload (Formbook)", "value": "ad37d8b7b4eef7682e4fce306c3df8b4", "object_relation": "md5", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763745, "uuid": "55d22769-a05a-452c-aa6b-82239d6cf638", "comment": "Malware payload (Formbook)", "value": "7e45163b6a279fe382de729565ff07bc6c729542b8ceaca31f989ef3cc2213fe", "object_relation": "sha256", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763745, "uuid": "8b475776-470d-4208-84fd-ebbd0cc2876c", "comment": "Malware payload (Formbook)", "value": "c079bd8fe3ad053d55686bb674c7846612990e9d", "object_relation": "sha1", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763745, "uuid": "8632b426-0786-49ef-9616-46ae14fbc829", "comment": "Malware payload (Formbook)", "value": "2721a7ab66c05efcdb14e6d9101c8aa750f0d451f299a39fb462417f12b997169c5f96688cea5d50e55d6b0dd3e795a0", "object_relation": "sha3-384", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763745, "uuid": "aa2541b6-69b3-47ef-ac4b-6d4cc5718ac9", "value": "T13A6423EEEEE5AD7FECE067A00973B47071BAA5414A028C7FC573B32122EE458558CD64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763745, "uuid": "49bfbeb3-717f-48c5-8535-700b98ceffeb", "value": "6144:96TumVC1k9d2q9MFUyTvteMZVMj/FUYq5Kwojp/n7WaY3zfl:9uup1k4qzCeGV0kKZn7mfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763745, "uuid": "41f8f97a-5a0e-4a67-972c-b9618c0046e1", "value": 312640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763745, "uuid": "dce2812e-c9fb-4251-9ff4-f1e41fddbd5a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763745, "uuid": "0ba0e633-b3a0-45e4-af53-d8b49258efa4", "value": "Quote No _QU 6543572_17654,pdf.daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe290d74-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637736707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736707, "uuid": "5630d9e6-95d7-4757-b69f-dbb77ab23877", "comment": "Malware payload (Formbook)", "value": "4a9fc8c0c8f250f8f7600e6d5131d583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736707, "uuid": "6f842752-b9b5-4092-b14f-bff278e0704d", "comment": "Malware payload (Formbook)", "value": "7f15af6ad30b84b5047a47d92a2319b1043dc00576d80a5cae1e8a23fcb97854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736707, "uuid": "f706f66f-f8c3-42d9-880e-a75aa8f53d34", "comment": "Malware payload (Formbook)", "value": "b40a9aee08fc5a24881e6543f0429011de85897f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736707, "uuid": "e997b960-a2f1-4149-82e3-8f107d67d20e", "comment": "Malware payload (Formbook)", "value": "3bb11aa5ab493b85b2e1ce35575f25e6b3366c416e019a89f8f19b7c4f3bbaa2d3b5a1140f706b28c0f82534c2102e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736707, "uuid": "60a72303-cd3e-4984-b548-27169ef5a634", "value": "T15664239B98D1ADB7F6200A324FFBABBFF33FDDC502476A4B47142E8B64914E54214192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736707, "uuid": "59ab4a4b-ebfa-4f26-beed-1d5d0b280ff7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736707, "uuid": "aa5471d5-b81a-479b-9b2b-161409d296d9", "value": "6144:rGibCUNQqF0wIZqiDdkkQsvCW7/wyIRMb2bdttrDct0v2RatqFmAyXpr3BCmAmNT:P1Dn5kjvLwhmbKVrDQ0ntS8pr3BPAm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736707, "uuid": "0a8fb606-5262-4a5b-bd0e-f5b349a44a54", "value": 315476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736707, "uuid": "ef155997-b243-4093-acff-9b8f41a7c87c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736707, "uuid": "52b8ce17-266e-445d-a8ed-8e698fe2468b", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c2de05-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774490, "uuid": "61af7098-cc9f-45a4-92f9-35175fb68f3f", "comment": "Malware payload (SnakeKeylogger)", "value": "ae344fd804ae3befe0fe688ea1b1ddb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774490, "uuid": "64c03763-ad67-415c-b000-6670fdd25a9f", "comment": "Malware payload (SnakeKeylogger)", "value": "8006046e7904df8e41f08e180e95b0370bc167269d2e932e2a04ed6b296f5611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774490, "uuid": "26620139-d4a5-46f7-a985-d4072d1e4bf3", "comment": "Malware payload (SnakeKeylogger)", "value": "0311df1fd34a64a89a7890963cca807f810f7ecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774490, "uuid": "7b0d1c5d-427c-4f1a-8c87-27c52dd4c17a", "comment": "Malware payload (SnakeKeylogger)", "value": "9834c2f54cb97215fd6ba2742298079c4a0c90e7a5d8eae06a4127934bfed8aabbebe267a24b07eb96d922c1e2a987d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774490, "uuid": "90c60814-e89f-412f-a076-4744bed12a9b", "value": "T10605EF29A4F3E727D8C2383F0AA9A66CB1D52945DF031FC2E2855E4B5B153E643CB742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774490, "uuid": "5c5d65f8-155d-47e9-a563-5d062284ade1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774490, "uuid": "8d9b8286-26eb-486f-92ad-d55767b0c5de", "value": "24576:S84TcpOprHgFDl6gpH/AdbvpGuSxlOHJb:xp+rHOlDteGuSxlOpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774490, "uuid": "3aeb4170-bef4-4629-a2af-a52a4451a752", "value": 826389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774490, "uuid": "1cb8e7f2-af8d-419d-ad5c-523c0bd5501a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774490, "uuid": "379db827-38d8-4303-8919-1c82b00b3fe0", "value": "AGM-76866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d6167e-4d02-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637743157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743157, "uuid": "5260f329-0c3e-435e-a235-4fe5bcc52148", "comment": "Malware payload", "value": "433cb1d1f420ef82acdd62e7ee242523", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743157, "uuid": "73da1578-9300-478e-9dbd-a5d1e8269be8", "comment": "Malware payload", "value": "8117a3bdb837a0cbbb9e84690d93e8187ac40fd9ce29bc92513bdd4f1567e405", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743157, "uuid": "6ec97cb4-1db5-4a68-bddd-a6a1f4d9236e", "comment": "Malware payload", "value": "a285982fe688359bcb9eccf5516c2f8061b9183e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743157, "uuid": "578f67bd-5917-4214-9ce7-41dbbcd612ff", "comment": "Malware payload", "value": "b4dc795a4c69e79034f755d191e97ceb6e52d27e564f5b4925ad314ef06a44464a80da7b3408fb5f2aa6095a48b8fd0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743157, "uuid": "58f41653-5dac-49a9-8556-318212e5d4c5", "value": "T1C1D33900B5DD9035D5BB427340A6A603077DBD26DF7A8ECE6BD90C895B784D0AB39B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743157, "uuid": "79b426fc-1327-4f33-8e1a-cea83b881105", "value": "db423eaafb40ad4b9417bac3a70ecf33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743157, "uuid": "9aea8a41-e4d3-422a-8314-b577c574f677", "value": "1536:wUswQdth4su0IUthE3qg5PyKimjlkIwmMu72U0iJxPPeCtcrW9hdt+RIRP1neXZI:BQdthzrHl0aKimjZMu7zV0/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743157, "uuid": "27c41b1b-cd1f-4352-9203-97c0f740531f", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743157, "uuid": "615d3b7e-92a4-4cd6-a783-03fac42270fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743157, "uuid": "450a3216-5293-42cf-aee6-e4be4193f4e4", "value": "SecuriteInfo.com.Variant.Zusy.407187.18275.26447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df55f881-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774451, "uuid": "50d1746d-73ad-44aa-bddd-47509579fbc2", "comment": "Malware payload (SnakeKeylogger)", "value": "e7720ec3068799c88b1457db3c346f80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774451, "uuid": "a20a7af7-10d6-48ae-aaf9-41888b35d3a5", "comment": "Malware payload (SnakeKeylogger)", "value": "8247b8fabf058c2b719647eb01a5dc0f72da5df5730f6152909f12d9cd1aaf50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774451, "uuid": "d7ef25fe-4263-40aa-912b-20dada85cb05", "comment": "Malware payload (SnakeKeylogger)", "value": "fd66a99d3ec26102417782c77972e56d41b588ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774451, "uuid": "272a9b69-3f9a-4c37-938b-3640d81bb2c9", "comment": "Malware payload (SnakeKeylogger)", "value": "01d219bac8236bc873c5a068e6f2e6284bdadbf53d23cf0fac143ebaff2251ee21d170fe262ae98f78113762dcb13989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774451, "uuid": "39d428f1-a00d-48ab-9cc8-dafd59f3eaeb", "value": "T13C94022035B1E626C5B65FB6091020C02272F3563A21EB5F7CC9274EAD97F9B4712BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774451, "uuid": "f3ce7244-cd05-4eb1-9685-ccdaa9a532fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774451, "uuid": "bd118ce6-f8bd-47fa-9e7e-f1cca75b4169", "value": "6144:Ku2/T/Z90Ma/JoRPar67Fy1Sn3FzAZynZtOncIjKXdRNVRoQWQmXTFJC9W4TuJf:KuCMAyr6hOSn3Kw6GRDmXfST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774451, "uuid": "10404bef-7487-4bf3-8c53-1c8ceb69db07", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774451, "uuid": "0fbc8e21-1576-4df4-8c79-7ff1d22973c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774451, "uuid": "7a496314-a2d7-4695-8f1d-cdc90f679e19", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1745d9b8-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774544, "uuid": "757a0e7d-1ca1-46aa-b89a-c2b04943b4f9", "comment": "Malware payload (SnakeKeylogger)", "value": "480b2e4230b5c0b75225e94bd080ec10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774544, "uuid": "a57413b6-b5d0-4e51-8383-fadb16310707", "comment": "Malware payload (SnakeKeylogger)", "value": "82843afe8739f56da99a048306daf596fb7dbbf4b2b6890371cc232bbc28ab25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774544, "uuid": "d58aee7e-875f-4da4-9d74-07c618acfce3", "comment": "Malware payload (SnakeKeylogger)", "value": "103571672d32b79110e970f86806a9de5c927933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774544, "uuid": "b9d77d27-205b-46e0-b6a3-d3de61215470", "comment": "Malware payload (SnakeKeylogger)", "value": "2827014e2f7fe3ea5cf5f605568f6e983a1673a611f14c30fa89c7b65c5c6c62e55a4b513cbcc0d78bfb658906ee5034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774544, "uuid": "72d218e5-1086-475a-a752-b974e7c373c0", "value": "T19CB2183356698137ED3F4770B08049156BF4634F2C12A83FA6C47E8EAB87A0566D763A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774544, "uuid": "19ffc528-4124-41cb-8abe-8a301ee848e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774544, "uuid": "50ad552f-b7a4-4ec2-8806-7d215c9921ff", "value": "384:29bgNBLuhcNFNfCYi384oxLK7gONGDbbTpA1oBnalgjgovgyggugcginWwZQowkw:SANYlNGDtvBGFZwaxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774544, "uuid": "e89b03ba-12ef-499a-8a12-296b61509776", "value": 23898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774544, "uuid": "8efc5fb4-2616-41c1-81b6-4395cfd1c887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774544, "uuid": "73abc0f2-f0d7-47bc-9d42-d88281e79082", "value": "480b2e4230b5c0b75225e94bd080ec10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372ff54e-4cf3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637736802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736802, "uuid": "c9f5f8fe-558b-43bf-a68b-404e5734eece", "comment": "Malware payload (AgentTesla)", "value": "0fd3445656e0dcebb50064cdbb84c30b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736802, "uuid": "609eb66d-b9b0-46ce-907c-e8d16953202b", "comment": "Malware payload (AgentTesla)", "value": "8289b5b56dc79ad66378f89a1dd4e9e43f50f38984645358e7af0a496c597825", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736802, "uuid": "686fd928-108e-411d-8f8b-2c7961fc5e96", "comment": "Malware payload (AgentTesla)", "value": "f01b963d2dc737e8a7652e1df48daf52343e1252", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736802, "uuid": "3b3dd908-d990-4679-b7c3-0b167d2b39bd", "comment": "Malware payload (AgentTesla)", "value": "fc3430a438b8f93ac5621983170010c09cc6807c267867907ec604abb950879ab6dd6e131292971422748b104b5750b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736802, "uuid": "fb1b5bfc-7a43-4c84-992f-9c4caeb85ae1", "value": "T161A4023132D5A327C8AA4BF90C20A5C4237276427905E79D6C89A2DF1E76F618F23777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736802, "uuid": "a54ec7dc-85ca-4f5b-b0df-30d35e56fda1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736802, "uuid": "4b37db2e-7bcb-4077-bab9-f85b6ad5f0af", "value": "6144:Yyw8Y30ESEpBmdQBE9j04RXNwf3NP1kNwYnDf08QDkKMEfWlCYnrNxkt3pJUS:Yz30ESE3+1jn1+vDAwYnDJ3tprNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736802, "uuid": "43f8366b-a4c4-4e2e-8d33-30b95b66141d", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736802, "uuid": "4016a24d-db2a-4f88-beeb-39c2569d45dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736802, "uuid": "4685199a-1ab0-44ca-9172-62bf0880a78a", "value": "011#2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7e82c8-4d21-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637756540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756540, "uuid": "6537c6c1-1c06-467c-a7bb-cb001acdef8f", "comment": "Malware payload (Formbook)", "value": "f2b175cd1642939eadaa9e20623508a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756540, "uuid": "d76e02ea-9d87-4744-b182-a42ff0976ebb", "comment": "Malware payload (Formbook)", "value": "832160e3e8d0fa8b10ae46a52268d0f2aa5a29d2e084c255babe7423c696db53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756540, "uuid": "5e18878c-6a06-4e6e-84f8-cbde96041711", "comment": "Malware payload (Formbook)", "value": "361e3dcd3921513f0c67078c627efe0d90d62269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756540, "uuid": "ccb01a5f-a93e-4cd3-84f4-82ad2911c0cb", "comment": "Malware payload (Formbook)", "value": "2ce43b893848b9019089d20e49399d356e963a2c752693fb55b556475951ae6f1e81504697fad5986194087ad3b931fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756540, "uuid": "24121627-d69a-41b9-afc0-9ad5908126a3", "value": "T1C96422D2B0D00169FCD319B284FBB73992BA4DDA42D71A0B4755BF772EB21C30859D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756540, "uuid": "5333bce7-a1d3-4e5b-abf7-6b4521fae3c5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756540, "uuid": "daf452f2-7784-48cd-8c0f-9005d3a3c2f2", "value": "6144:LGi4zy1K6Qra0QUJp2+bMb/V3um6tAMi/f5pG5rgQBPvANstBPNrnxp:Gy1K97+b93CkpG5rTFvANEPpxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756540, "uuid": "ba80b2f1-69d8-433c-81de-4778a1e9bb53", "value": 323440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756540, "uuid": "37df2fb0-9ac5-4b8c-8790-284e71bc5d12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756540, "uuid": "119221ea-7276-46a9-8985-723948d5ceed", "value": "DHL_119040 al\u0131\u015f irsaliyesi belgesi,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60c8893-4d23-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637757604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757604, "uuid": "895b8ebe-ad5a-4aa0-a999-6758cd4c1ffd", "comment": "Malware payload (AgentTesla)", "value": "77d6bab3943498350c7e66b4cc53aa3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757604, "uuid": "d03bea8e-76f4-4de2-afcf-44b79e15a69f", "comment": "Malware payload (AgentTesla)", "value": "8365ffa8136c7f1c02dbdba9e8bb1960bf33715e59beee3c26731b11c7f3281f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757604, "uuid": "9199b164-42f2-4372-89d7-0326c5ddb55e", "comment": "Malware payload (AgentTesla)", "value": "bec2abe8d4e52e2b0dea0da89adc7e16ca9d67eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637757604, "uuid": "d556101e-86fc-4778-b702-d19ba6586a85", "comment": "Malware payload (AgentTesla)", "value": "e9cb42a4a885bc5ed3bace40fae4b585e4b6f706fcba4794f5980bfdb40faf3834eb569b124791a83659f214b27e977f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757604, "uuid": "ad913230-fb51-4265-8297-b29977cb9684", "value": "T10394016136E96367CDBA4FF408209081677362043E18D3AD6CCA66CF6DB2F454B61BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757604, "uuid": "37b7a276-76b1-456a-8f47-6a8a51133504", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757604, "uuid": "25b36859-eb71-49d4-bb58-da890f021cd8", "value": "12288:s/pLNRIVmzdmRF99JLWicbOF22r479sWf:OpLNRf0pLWicbOAbjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637757604, "uuid": "045a2623-233e-4acf-a32a-2ec7c6f80ab1", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637757604, "uuid": "eb2f0e1f-87a3-4b45-af41-15ec797e99bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637757604, "uuid": "5a7ff003-83ec-441c-89da-c0a1e72dc936", "value": "22936-3-JB-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa45177-4d61-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637784383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784383, "uuid": "39413bc8-30d4-4a6f-993c-5bf17f522463", "comment": "Malware payload (Smoke Loader)", "value": "646cc8edbe849bf17c1694d936f7ae6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784383, "uuid": "f4e1f904-8078-4220-9b71-0da8082eb00a", "comment": "Malware payload (Smoke Loader)", "value": "836e9de6ff5057a4964402ed5a9695e270a7db9e0d8b756a99203befa70fc4b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784383, "uuid": "17ec96e2-dcb9-4615-b952-e8a24a8cbb78", "comment": "Malware payload (Smoke Loader)", "value": "68b8e56cd63da79a8ace5c70f22cd0a6b3672497", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784383, "uuid": "1b4b6281-3ba3-4c87-979b-1375adacf820", "comment": "Malware payload (Smoke Loader)", "value": "0e377bd048079c201f06db57a9f7fc3eb6a2dc980badc8ae39b94e163c7a6307c7d1d641d000b725123891386b6c0bb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784383, "uuid": "fcf341bf-7ca2-4b88-9072-4ab73e4607dd", "value": "T166E3BE1032D08035D5A72A3778A8D6A11A7EBF3EA770824B779412FF1F702D05AB579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784383, "uuid": "02fc6206-3293-4c05-b0c6-4166d581b147", "value": "bf61ae69989d1072f08e18d6fa6b3469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784383, "uuid": "9159be10-953a-4eaa-be46-c708e3794734", "value": "3072:d+oemgaoSit+07zjSUjdz6yyU9bRHRvwGWugyMreI2:i3aI+07HvRz6eiuorej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784383, "uuid": "0561f1f1-557d-4ba8-b9b1-b0c67e3873f0", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784383, "uuid": "d0195a69-3291-476f-8750-b6cdc016885a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784383, "uuid": "3944f470-b64f-4c4a-937c-f8e2f36e6214", "value": "646cc8edbe849bf17c1694d936f7ae6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a23f46-4d57-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637779910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779910, "uuid": "38d5028a-ffe7-4b87-85e9-2c0dab8e50e7", "comment": "Malware payload (Dridex)", "value": "5edc20b587b422b5fb0e6ece55948813", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779910, "uuid": "0f90b6c9-f22d-4e38-bb6a-72b56f5bd8ff", "comment": "Malware payload (Dridex)", "value": "83b5451fe058cdd8b916d73330c3fa2884b953ee2b5f56fbe75e3bb4bb3f65b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779910, "uuid": "e1e655d7-c90c-4c87-8fce-3f317f8ff159", "comment": "Malware payload (Dridex)", "value": "e9fbb44cc3d3261aaf97b35c16123a594f0f6ff3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779910, "uuid": "19ba4110-ef72-4daf-a56d-78397e55a5bd", "comment": "Malware payload (Dridex)", "value": "6631bda950044ff05f913e6c65ed8c0b0bbb53ce418c0249622fd074cfa7e22cd42f7784acc37fdc2defd04c57ae7e89", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779910, "uuid": "08cf40da-f4ae-454a-bb90-ec55fc46d2f2", "value": "T1E1F4A005AF45184ADB1ACA342B3BE705BC9FFB1065FCAF3025654BEE157768E640E22C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779910, "uuid": "c8500840-d20a-4dc1-9a4d-61804c8ec321", "value": "e32f79a56269ae02e47b49c1ae49adb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779910, "uuid": "4e30ffc5-2b6a-436a-8518-fcb0b1c52d03", "value": "24576:Xmi7RlnpzHL/R17VZfGCOeeSYRRWXNp4/0:Wi7RlnpzHL/R17VZ5OeeSYRRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779910, "uuid": "662af922-0d1b-4f27-9c66-7b8e0cdaffef", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779910, "uuid": "af557ea9-ea2e-4b69-a0b2-ce67cde9f53f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779910, "uuid": "1b3c5f8c-fc02-4360-9a54-d475c40206bb", "value": "SecuriteInfo.com.Drixed-FJX5EDC20B587B4.1828.731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15671c86-4d21-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637756502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756502, "uuid": "c1481dad-de8a-4700-9db1-555123513cbb", "comment": "Malware payload (Formbook)", "value": "0c0a09689b7b8e0ebb0aa6c88fc9c533", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756502, "uuid": "24899bdc-5ec5-4ed8-8691-7c3ee30f1414", "comment": "Malware payload (Formbook)", "value": "85233dc9996ea85a276244c8f3c16e666589d412b7c89f6a5339675b632655ed", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756502, "uuid": "8689591f-3fbc-4049-a4f2-3254a69e31c1", "comment": "Malware payload (Formbook)", "value": "3ccbd8d0377d8756f3a4ed2cf582515837a12037", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756502, "uuid": "2c275cdf-2a3d-41a3-894e-9d639525fbc3", "comment": "Malware payload (Formbook)", "value": "9528e30508aa2683b319b33efc135a2e58029a5b28784ffe2293bf79dcfba41e6e66ecea9e499aaa2064c81f8b853b9d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756502, "uuid": "270cd1ba-5401-4f22-ab92-9a6fd4c2a2bf", "value": "T16284232C55BF9CF204AA7C74CFCF3EA8BD2CC9104EC67C256A51D8A06CA779425E9309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756502, "uuid": "e92b4407-9a78-49c9-8507-e77951a4f763", "value": "6144:wF6XhQouMnSQBkl/PaAntNu5aXqdPPU0k7jLyU2v6BN8AQWioHR00Isz97rHH3AX:0DouMnNqnBnfVqdP87jLyRv6b8RWigGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756502, "uuid": "e7f10a59-e0ad-48a6-9428-6b78ee9e5a35", "value": 371266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756502, "uuid": "b519554d-f946-4e89-8a92-c93b91c099f2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756502, "uuid": "52269564-57a0-4425-800e-930374274448", "value": "Replacement declaration.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc6edfe-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637779146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779146, "uuid": "d7bd6944-6b11-4eb9-b333-eb7bb70b2ef1", "comment": "Malware payload (Formbook)", "value": "dd9ffa7cabee8b78e5148c26d704cee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779146, "uuid": "3dfca5f9-90bc-4e28-a17b-ea7d8673db0a", "comment": "Malware payload (Formbook)", "value": "856e1c83f34ed788e607571d7adad436f8d5992cf052d623287f89e9d63aebd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779146, "uuid": "b363c373-ef2a-4c6b-a242-bcbe67ead8cf", "comment": "Malware payload (Formbook)", "value": "11f426806b22d255a03187b27b79250cf0904297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779146, "uuid": "54f1291c-e93c-4f08-acca-1b2f9c9ac897", "comment": "Malware payload (Formbook)", "value": "128b7fd4239d2e582ac762d3ab3535e987fc0bfe3dc32d30fb98fb0fb84e6deb63d1fd36f946c608320e820d4ab73cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779146, "uuid": "3c2e3991-970e-49ba-94fc-6b52798ed321", "value": "T15764135EBAC9486BD9AB113016B99FE9F3BE039A11E30E0747D41D2B2C236D617052F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779146, "uuid": "8b8949c0-d60b-43fa-b4e0-378143fa2ef5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779146, "uuid": "ef9bcdc0-a136-42e4-9fbe-2679c594fe71", "value": "6144:rGiu9SpUEaBWPgsFiMabvXrxkv/JkjiHCSreXbCmltyi9z/iR2ahGG5xt:zUSMbDxkzHTeerEz/iZFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779146, "uuid": "37f77634-bce2-496b-9c26-c08348b26b28", "value": 317920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779146, "uuid": "ddaf2cf7-00d3-41ea-bd74-0b2fc4cd571c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779146, "uuid": "fd305858-7f68-4aeb-a7da-ad6a3410be49", "value": "dd9ffa7cabee8b78e5148c26d704cee7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68e64c6-4d2c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637761605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761605, "uuid": "42a7821f-2d77-4484-84df-2eb1ab989831", "comment": "Malware payload (Dridex)", "value": "e62314e4af437ffd1b9f27bc0cd817ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761605, "uuid": "6236b129-652e-4132-934d-18ac83a61bcd", "comment": "Malware payload (Dridex)", "value": "85cebd2f3ed53d4e52ea415cfdb52bffb74710d9d0ee3516a55880ed8aab99ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761605, "uuid": "bc478618-40ef-4dc1-aed8-eb4a0ce207fd", "comment": "Malware payload (Dridex)", "value": "c8a505bef50c361ae43da6b200e921f814fbe321", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761605, "uuid": "a375fa0f-170f-4856-a6fc-9c2a2cd9f288", "comment": "Malware payload (Dridex)", "value": "6313f9492cf6c7fee693a528e276e289e0bc5f50fd212e32500256ceee04f199f90c79a708aa22cab343ebe37f464014", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761605, "uuid": "366f3c40-d93b-4931-b4ae-7c8f51018a0b", "value": "T1CB73F20FA21278BCC276117E404989F21413512FAC57EF6A386BF21429D977BCFBA5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761605, "uuid": "b8407cf2-46dc-4f04-a787-bab154b7b74b", "value": "1536:UWbP2CET+S+agP7nA9u9DE24ygfuqfiYgd/O3:VET1k7TAKaiYgd/O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637761605, "uuid": "2bcbbdc2-1339-4b22-b084-5da6aa6fbbc5", "value": 76629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637761605, "uuid": "b3cdf468-4cb1-4e9c-966d-1e68e674c85e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761605, "uuid": "991da6b0-4c63-4649-a280-cf6faa855172", "value": "007422621.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b413ed37-4d47-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637773090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637773090, "uuid": "b1404dfd-4c36-4f2d-9067-89da64c1d9ea", "comment": "Malware payload (Dridex)", "value": "5d100282fa245a22e4d7fd4d3756dc73", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637773090, "uuid": "0e10feb6-7d25-4086-8bed-b185a6921ce1", "comment": "Malware payload (Dridex)", "value": "85dc1d55b4832a6669a8de1a1d69151f26a63a3ed8a0568a77d89aad31f57712", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637773090, "uuid": "8c0ffe53-fbcf-4c5d-954e-d1ea019e121d", "comment": "Malware payload (Dridex)", "value": "e616e28b6c93b59f48bd119ed1d722794b95fd8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637773090, "uuid": "d0d3ad04-fadc-4f84-af2e-d1fb62502522", "comment": "Malware payload (Dridex)", "value": "5b11418ff8b02ef0b284d0f843d265620d219dbed4cd567fee46c8697382c00211c7c4d532a18be80f48a7d361b2b4d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637773090, "uuid": "a875b167-7796-4c98-b8e3-a9976965b940", "value": "T19783024F500768A8C126163F409FA5FB1825C177986FFEDD302566640CFB2D36EABAB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637773090, "uuid": "d937fe8c-fa62-4eea-84dd-04cdb1145eed", "value": "1536:UW0P2CET+S+agP7nA9u9DE2m3fihPOWDlKyM6bgdRV88:VNT1k7TAp+P4yPgdRa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637773090, "uuid": "fb48538d-43d3-4a53-a30b-913761c62c8c", "value": 85008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637773090, "uuid": "b82cf2b3-fcb0-47ca-b05b-298c8c91f5e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637773090, "uuid": "c5e63aac-75c3-4af1-b040-e9db8827c811", "value": "Netflix coupon040693525.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049a06a3-4d03-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637743589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743589, "uuid": "43c7188e-269f-4efa-b0c9-ef10c1031605", "comment": "Malware payload (Heodo)", "value": "3206ebdbc14163a255aa843d02fe2313", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743589, "uuid": "07241ded-b873-40c5-868d-be33a60190cb", "comment": "Malware payload (Heodo)", "value": "86115a76b9c2561a497fc18912b88764d317f400e68e4ed9461a11c7e35c2872", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743589, "uuid": "f2d53c25-6e2d-42bd-b371-567d1e0d7185", "comment": "Malware payload (Heodo)", "value": "db9c858386090717c756bf7c00fdd03e9427ee68", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743589, "uuid": "8dff27ca-b210-4978-89cf-3c7864cbbe7a", "comment": "Malware payload (Heodo)", "value": "78c58b710dd32ebc49aec5cc8d3def86713fc2005c364bda60e9415215903f9aaf4dd59667430b65648b442d2d4ea793", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743589, "uuid": "bdfccac1-0bcc-4df2-8e60-5ba660acc41b", "value": "T1A1749E11B683C072D5BE05307938CA9609BD7D714FB8CAEBA7D40A3E4D742C19B35E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743589, "uuid": "15611638-5cce-4d01-90b7-1d5b1d2c30c0", "value": "592e7c0ada319cfa83fd5b398b97e096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743589, "uuid": "7352eec6-b92c-4f40-80d9-0c6b4aa56293", "value": "6144:sofeyFTe2PZLNYN42++m/wqpwTIJtoAOLF5Njqf1k8zwA:sofeQZON42zmvJtoFRqu8UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743589, "uuid": "43769661-9fb7-4b82-bf5a-3293552354d2", "value": 343343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743589, "uuid": "ef637904-01d1-41a9-a192-be809163bc5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743589, "uuid": "7f0a88a9-5cd7-49e5-baa1-3cfed92c27b3", "value": "emotet_exe_e5_86115a76b9c2561a497fc18912b88764d317f400e68e4ed9461a11c7e35c2872_2021-11-24__084625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292ca7c6-4cf8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637738926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738926, "uuid": "1334215a-d2ed-4ce8-873e-e4b851deba03", "comment": "Malware payload (SnakeKeylogger)", "value": "f7514018cb7c12290f42d1f6c61aec18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738926, "uuid": "341d181e-0440-42e8-b60c-16d87dc26aca", "comment": "Malware payload (SnakeKeylogger)", "value": "8784589c5d74be020a26f0bbcf623763672715a3ca74dda141f9e6f823ed8247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738926, "uuid": "2bf276d0-aa85-42cc-9f05-f1277775df56", "comment": "Malware payload (SnakeKeylogger)", "value": "42f46b8f8f3dc3850e89e9057f33515481395533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738926, "uuid": "f2dd4076-f2eb-430b-829b-36f6638e9d55", "comment": "Malware payload (SnakeKeylogger)", "value": "300b340c1af61e9831e2a1f156e1ae18b2ddd4ec39e6232d179f0962bd2e651cbf207976f4ffeab1c964d1f64e550b7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738926, "uuid": "a3148477-a6b3-4dae-bc32-f91898c94522", "value": "T1D164F17132A9A357CDBA5FF80820518943B7A2453A14C36C5CC926CF6D32F574FA2BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738926, "uuid": "7f6a0dcf-9b74-4ded-8f47-99c110b2e7cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738926, "uuid": "7d847da8-6f24-4008-badd-877bdc7c6f4d", "value": "6144:DmRTcScUJGsunbiCLsiYkq2htG1F2Xh4KuDLaQxvB3SBf6u8TXP+2p:DmVzqsobBmkq2hI4g3aQvYf6XVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637738926, "uuid": "ed65a91b-624e-4726-aea9-97386754e8e5", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637738926, "uuid": "bed9f642-0efa-495b-8cd9-5d6e9af29898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738926, "uuid": "81862557-1b43-44cd-877a-a66059445405", "value": "Halkbank_Ekstre_20211101_073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465f3920-4d3a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637767322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637767322, "uuid": "47b58cf0-99a5-4660-96ec-157c9965ff2e", "comment": "Malware payload (AgentTesla)", "value": "1c793ecd1e37bc564729d4dae9ce09a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637767322, "uuid": "0ebad344-aa2a-4b54-adb6-65efc8c2a463", "comment": "Malware payload (AgentTesla)", "value": "87c3421fa204acd14356d641d0e7c48a66201edb086db59adc554e6068b21cb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637767322, "uuid": "28bdd8f7-7b9d-436e-8887-b1cb6d388247", "comment": "Malware payload (AgentTesla)", "value": "f9ca398c51792d270e3a4f97ca51d04f6809c3eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637767322, "uuid": "f55c6412-0a2d-411b-8740-3ed29cff3b56", "comment": "Malware payload (AgentTesla)", "value": "4a6031cb06bb0e7734f5e4c2438b94c3e10f850230d62525603cc848a430ae13a9ce43e9109478de79ee1b7cae61ddb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637767322, "uuid": "e38a8db5-d6bb-40c7-ac23-cabf068a214a", "value": "T116D4015533986BA3CC3E5FF00972E1C513B2751A6A50EB1EACC521CE2D36B155B22BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637767322, "uuid": "1157d2ea-c1fe-4341-a728-1e7ac70730de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637767322, "uuid": "7029ee07-b6eb-43cc-80b8-a203cdaf9fd1", "value": "12288:+atD00YG5vj+ngeZhUOXTJHc1v6aqG0542JZtS9WiLWQecpdffEQmo0fi6:PC0Y+vtevUODZ0M54cZwLWQ2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637767322, "uuid": "e849ee56-5d1b-4f64-9582-67fd92b5e3c5", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637767322, "uuid": "63d30618-2712-4ef0-b0cf-3cdbaa1383a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637767322, "uuid": "c553c274-b18c-47e5-ba63-4ef245b0e3ac", "value": "ORDER INQUIRY-PVP-SP-2021-58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cf0713-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764769, "uuid": "092f6202-2f8e-4ee8-909f-0f50742ed378", "comment": "Malware payload (Dridex)", "value": "bf53b67e9ce48c1e2c1d4af02428f132", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764769, "uuid": "66916f87-e212-48a8-a8f6-1af420e94cbc", "comment": "Malware payload (Dridex)", "value": "8939e276f27575df1ec3ecee791e30c0a46b416ccbfeadc57ec9c94ff97be22e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764769, "uuid": "d3cca4a9-156a-4fb3-8b0c-8e75d7b6f3c0", "comment": "Malware payload (Dridex)", "value": "1aa5c4354efdbd50a89164c967e3ebc6b1708915", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764769, "uuid": "6e070dc3-20bf-4cd7-a5be-b7697f7a867b", "comment": "Malware payload (Dridex)", "value": "22898028734a7e2f241708cf5ae16ae2aeebc2e4412494539dd6919c2d2efde758a454b6dc9e8d38926628432337a36e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764769, "uuid": "cb70a42a-5180-4385-b9f3-5b742cc3b596", "value": "T10FF48EDDB428F3DDC1A41B3312601B00594D7B9C964B28A9EEAB7CD5E2F4DDAC8D84B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764769, "uuid": "13bde02e-3f83-46fc-be56-664167863ba8", "value": "8c0e65d990aa46afbbebf4269ca1b019", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764769, "uuid": "8a266ca0-b85e-4979-8ae6-604b35a29403", "value": "12288:hgUMGSOMwSG0umMqCImuoOQa0W2KUdgV+2CFDLhbUy0sp2Xf:oVehIrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764769, "uuid": "b1d5f24d-fcbe-4146-92a2-507cd67820f1", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764769, "uuid": "d8b39584-931d-4bc8-b957-9bfef90f8bed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764769, "uuid": "e825425a-08a3-42e0-9682-d19da99c4c33", "value": "sjAPKtporrJZCRbeanerwopnigga.ogg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c4c6a3-4cf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637736807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736807, "uuid": "bfc9da2f-e090-4b88-ab63-d548e322c910", "comment": "Malware payload (Formbook)", "value": "0746ab0e18ffc91003ae60d1674455c1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736807, "uuid": "c20b7cc2-0a5e-4f2f-9000-b81ae48a1863", "comment": "Malware payload (Formbook)", "value": "89491f166db45daa484c007333d1e70e52663526d387100a7fa59a94f2aa397d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736807, "uuid": "cf6766db-3221-485a-9144-ee4446721eed", "comment": "Malware payload (Formbook)", "value": "33e09aee58b967f1934c55fae48cba183eccb8d0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736807, "uuid": "a631f27b-4e57-4d56-bc74-41ef36353061", "comment": "Malware payload (Formbook)", "value": "28ead554199c50611816618d7b6e86480ffbcda968df4e6f3d2684e815713dda8887c4769803b3f8ba438207d669fd91", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736807, "uuid": "c6027145-d580-4691-a762-9603c039eb5d", "value": "T1845423E99B8E4DB5E4441486703B7C01A33DF5DB223884E724DC5E6EFA17B08A7CAD94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736807, "uuid": "f0a0b994-3782-453c-9610-a31c1fbb25bf", "value": "6144:osps0XPx12PX+prinVrK2Y7YOTQKiBup0a9NP0bg2VoTWt1sj8/hvEP:ovKPx1zWnU7YOT7WuH9F0bg2Q8/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736807, "uuid": "46d4a194-9963-4058-926f-a5a411becdc4", "value": 306447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736807, "uuid": "650b9813-7ee7-4d2e-bb7a-d9ca2194469f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736807, "uuid": "057e5fe3-6617-478a-a1eb-13b2576dd058", "value": "Payment Advice_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fccd9cc-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637762748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762748, "uuid": "032fcea3-c7bb-4c89-9d68-262572066635", "comment": "Malware payload (RedLineStealer)", "value": "df0b6d01e27969cd7f4bdc8b8112da9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762748, "uuid": "e2ea6bf4-def9-411e-b004-c1147ad30a67", "comment": "Malware payload (RedLineStealer)", "value": "895e2ca3959852db5a4cdb30ab0520e038c9e2bec3cbb98d08e8c5e5ebe33be5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762748, "uuid": "756c1c8c-456b-4de1-b631-a69cf8aa9256", "comment": "Malware payload (RedLineStealer)", "value": "d2301cfcbdb66c4de11e1e10c304de687e6357a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762748, "uuid": "fa26a50f-6f2b-4301-852a-4daf3e5f72f8", "comment": "Malware payload (RedLineStealer)", "value": "baa1ad57fb39383e9e710d709fda8365601f257bc68488b027f5766d93c084e5c4adee3dc6071437ffc81c4f5e3de6a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762748, "uuid": "80f7cdaf-ef28-4785-9f5f-db1c1d985b78", "value": "T158E3BF2073F08035D1A3253058B48BA16ABABC725A7146BB77A4137F1F713D05AB97BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762748, "uuid": "58593ccc-7ab2-4ffa-b6bb-254dd5c957a3", "value": "bf61ae69989d1072f08e18d6fa6b3469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762748, "uuid": "6600d258-e959-484d-b9fc-8e6b0f82f75f", "value": "3072:V+oemgaoSit+07wLSBISQIs54RLSVpKg2:63aI+07wYwfVQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762748, "uuid": "f314afd4-ef67-4962-a203-de804f2be91c", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762748, "uuid": "a5d5484a-606d-4045-9814-c880f6220b0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762748, "uuid": "15969e07-8c42-4443-b5a6-c29c23c69f3d", "value": "df0b6d01e27969cd7f4bdc8b8112da9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd61201-4d00-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637742669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742669, "uuid": "c447ed02-c15a-4370-b0b5-0424597ad95b", "comment": "Malware payload (AgentTesla)", "value": "ec557e055c31db611a0eca2e46506e01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742669, "uuid": "2500b977-272e-489b-848d-a178a94bfba6", "comment": "Malware payload (AgentTesla)", "value": "8b8f4f3c2d0d60fe58b92585352ace981df26f4c476fd59f0bb635d9b5158942", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742669, "uuid": "b9d5cc4d-9b43-450f-8702-656c1aa837a8", "comment": "Malware payload (AgentTesla)", "value": "856acf8a31d26b5c74f2ed76d980940acd1c1aaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742669, "uuid": "877b377d-63ec-4e0a-ad98-66c01f791062", "comment": "Malware payload (AgentTesla)", "value": "892ee22a9583851a2ae38305a660c8f7e948f583603c53bfd73de96423d8ab0709471295265af9aa3485c635ffcbeea4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742669, "uuid": "01caf64e-24ca-49e5-a9a8-9ee04ab17c7f", "value": "T14AE48C81E5C591A4FC7AEB702976DC740223BDEDE870A49DE8DD3D273BFB6924420462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742669, "uuid": "199fe4c9-de9f-441c-b09f-c308467d0a2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742669, "uuid": "c0d39aa6-a733-42bc-8578-215099a1d873", "value": "12288:zA+2c/o7Y7u5y3uF5J9a9EpcN8pO0P7r9r/+pppppppppppppppppppppppppppv:sJc/fg62e8X1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742669, "uuid": "2748085a-da9e-404f-85f8-33a39b6fbb0b", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742669, "uuid": "a6103de3-02e2-4f0f-9028-a8288a15d7c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742669, "uuid": "5ff1f5e2-f316-4355-a356-e87efc3ceb64", "value": "DEBIT NOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd6825d-4ccf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637721509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721509, "uuid": "ab9f21c0-c870-42d0-a49d-bfde2736cd85", "comment": "Malware payload (Mirai)", "value": "b56a0145fce0165134db22cfad4901c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721509, "uuid": "06841378-f079-4f5a-afb2-9fea82231354", "comment": "Malware payload (Mirai)", "value": "8bc6cbba58930a76a7987b61fb3e133649f838b1892b034e453fcfbfb9142088", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721509, "uuid": "406285aa-a640-4506-9080-3681c62665d8", "comment": "Malware payload (Mirai)", "value": "dc0b0e3ff7f1a95c553f30ecbad7cfb7927d13fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721509, "uuid": "5ccc5996-a646-4aa9-9a4e-edc515f24e01", "comment": "Malware payload (Mirai)", "value": "f4c55b2e0b2c4c449198256d137bcba820ab9e92f017e9a313eb44479f905bd00cd7f447d2c286724e04203b9f23dff0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721509, "uuid": "e97ba60c-e78a-4bee-9969-251614d3b8e6", "value": "T196831881B9809E15C6C507BBFA6F118E331257ACE2DEB353CD145F6477CA81B0E3668A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721509, "uuid": "9a0b20ce-6b15-4e14-923a-49515c2d45ca", "value": "1536:CZnwPmWettav+9sQE1J5h81gysb9ly3yfvdx479mrsplDKZUtQBKXAVankX+F8Jw:nPlvKsx1/h8g/bDy3udW9mrsplDKZUtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637721509, "uuid": "e7d20afb-a92d-4513-ba57-4cefd353ca0c", "value": 83076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637721509, "uuid": "21101724-af5e-4354-b421-249779fa92dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721509, "uuid": "22951696-be40-44e0-bc4a-f53ede7ead8a", "value": "b56a0145fce0165134db22cfad4901c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077dd91d-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744453, "uuid": "256a807b-5f8e-44b6-ae3d-d7d7539ae673", "comment": "Malware payload", "value": "5ea92ba135a54ca8df8235c0f45f27cd", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744453, "uuid": "7e0a9b31-6302-41a9-98bc-c0a5389216ac", "comment": "Malware payload", "value": "8bcd9cfc9785631738380ab923b967b3697bfebb32db7822749ef81da28f6467", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744453, "uuid": "7641f969-35aa-49bc-b5ce-2cbc23f0c1b2", "comment": "Malware payload", "value": "9c628753b5dd3a3a699dbf128e51f86d3770b3a9", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744453, "uuid": "c6cef309-7ab1-4621-bda9-701be875df6e", "comment": "Malware payload", "value": "427100da97c79a12b773915903ab957a9af31caf39ab1a234e8be01996207d5d4c126e6dec0891cdf38e3e42eb632165", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744453, "uuid": "cd4276c4-40f7-4d07-a433-024d2ab1385d", "value": "T1DD85330821B97CE8F9DE022D3B7249D0C2ED32E1A441B1D676995CA55E3B1FE438ED78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744453, "uuid": "ccdaae81-6d99-4023-b3d8-4e2f5aa5b1c8", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYyY:IDSTOhnXSI0Wk5jG2nfBtkaeyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744453, "uuid": "99cae5d0-df72-43ea-89d0-0fbdd0cb5347", "value": 1806336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744453, "uuid": "e5848e3b-614e-4570-8636-c0f0e07ec434", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744453, "uuid": "8edd5383-9137-4dfa-8e4b-d05466d9dbb8", "value": "8bcd9cfc9785631738380ab923b967b3697bfebb32db7822749ef81da28f6467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb1e73a-4cfc-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1637740758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740758, "uuid": "9090c08a-ae55-4c6c-88ac-621fb9891e8f", "comment": "Malware payload (Hancitor)", "value": "2e9d26b62238bcac9ba6798f8a22ac98", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740758, "uuid": "d4d55fe1-d3d0-4ec7-be7d-ddbf828eb64f", "comment": "Malware payload (Hancitor)", "value": "8bf91ee9796419a5aeea1f27ecf8f10b0c8fcac3ab335e51c3e284ccc0527d2d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740758, "uuid": "b1157954-3fad-4662-a0a3-5fbef5162fcd", "comment": "Malware payload (Hancitor)", "value": "8b1bf7fa08e3571bd8c024209b0d06240b6eca9c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740758, "uuid": "c0141470-3194-47a6-8ba1-5dcf6e4e3ef1", "comment": "Malware payload (Hancitor)", "value": "bcbd444447cc4ad54c5bc2f995084462a5f80d207399f075caaf8c9d880e2931d7cd888aea87edcd833e03606e82f1ac", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740758, "uuid": "c618039a-1b2d-4859-99a8-8a489ca9a618", "value": "T1D015F100BA90C026F4B301B84AB6DBC8A63D7D70BB6449CB72E5769F2B359E05D71397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740758, "uuid": "b8cb6e21-d7f0-43b4-8f71-2ec1589f4752", "value": "24576:WEIj8oOSRnXHnv3L0cDAPpVTAo3bUptxzIDw+H7W:WjRXHnv3owAPHsow90l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740758, "uuid": "de8db7e6-d38d-4c2a-bf20-60fc94c4c824", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740758, "uuid": "ebe0b552-95cf-4778-9c68-e6249815e041", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740758, "uuid": "ca434f03-ae4a-4b8a-9c35-8e14195f8aec", "value": "0617_1876522156924.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda458a9-4d12-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637750450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750450, "uuid": "b24f1f06-aafa-4a94-b849-ba7071ecf9b9", "comment": "Malware payload", "value": "3cae228662905187b04ec3986fb210ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750450, "uuid": "f4059171-abfb-4cbc-b1f7-b652850d4803", "comment": "Malware payload", "value": "8c2ac48e0bd066205c489cf5609818d547d037369f66c292ee1a5056f0c905b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750450, "uuid": "2ec96cf6-eb4c-479c-bab2-7feec7a07b9f", "comment": "Malware payload", "value": "47531895b9040423b2b2ab3deda54ead1d56943f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750450, "uuid": "09211377-0792-43d3-8285-8d2d4e0ee507", "comment": "Malware payload", "value": "a4118b160e4cb8719d96d6a32dac166f25a6cb90fa9641e9f6f8db6a6e019299d401f4636f091432dc09425c49293eb3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750450, "uuid": "6751cbbc-ccaa-41cb-937f-d38ace3ec696", "value": "T103D34A00B5D98830E1FB127A4165AA120BBE7D22DB665EDF2BD80C8D17785C0BF75B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750450, "uuid": "e654a7f0-9b76-49ca-8a77-a9d9515da1ba", "value": "b14b2c67f4fbedc4414770849340fc14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750450, "uuid": "9b8ae121-d3b6-41ef-a4bf-dcc83b4ebff7", "value": "1536:h2VBC0CNw3nOQisu0EEhEIGt4CBLP3CfA1cKbqbelij92TsptldiVyi95+ltKczq:hjw3OQ1EEeSWtcKb4lHdb2KECp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750450, "uuid": "8c783dc8-47c4-4d86-a297-7368fba6dd49", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750450, "uuid": "4c4b7c75-ea60-403f-8a33-a17483533e16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750450, "uuid": "d24b3eca-6e10-4fb7-9c84-718fb4c71b01", "value": "asnxstr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df012d53-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637736654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736654, "uuid": "ae83ce7f-7dae-437a-8d1d-1ac872333266", "comment": "Malware payload (RemcosRAT)", "value": "22cd24322fa73e3ce06ad98bc6d56d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736654, "uuid": "fd16f31f-b5dd-4b7e-a1bc-6dc4d7f95750", "comment": "Malware payload (RemcosRAT)", "value": "8c2b13e466f74fde42b710b8f7f80b8d64f2fb94c84845c8ea6345df416c8d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736654, "uuid": "8d9ca3a0-c4e7-4bb2-acf7-fc6e48bb95d1", "comment": "Malware payload (RemcosRAT)", "value": "bb7595120da556f1f2c4857b6c2ace291b88d35b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736654, "uuid": "be8d80f9-9859-4059-b55c-f4b88bacb9ea", "comment": "Malware payload (RemcosRAT)", "value": "3aaad8847b1ddb6a878eff4b54b2f6288030456a0d08b3bcfbc0f8a1f379a1442b77f0743071ae9a0ac2b8cc50915c99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736654, "uuid": "f7f8b8e2-be64-4db5-86b6-64b632e38497", "value": "T1F5948A3565F3E723D981393F1229A6AEB5E92944DF431F92E680AE5B27513F043C7382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736654, "uuid": "10e44212-e4c4-4687-88fe-e2b1bd75673f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736654, "uuid": "aa4fbd1e-732a-41d2-97b8-0924ef48ad8b", "value": "6144:UGi408ydTcnXKMzVzWHcx1WWB2RKvegj3aMwADEqD0St1XrbVotSLIqj:S84TcnXTx6cDWzRS3akD913muIqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736654, "uuid": "c268d952-d877-4cda-ba1f-f09cb073bbc4", "value": 432567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736654, "uuid": "aa78b71c-c78a-4e13-ba67-486ad49d5cf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736654, "uuid": "9d63f60a-2fbf-4ffb-9d49-8d0c2e3824a3", "value": "Original Bill of Lading_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5e3e85-4d26-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637758715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758715, "uuid": "69334665-ca12-4ab4-a8db-21094c9bc8a9", "comment": "Malware payload (Dridex)", "value": "9f20ef5ca2ff0d9476337784dd582cd3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758715, "uuid": "f730991b-c2c6-4a6c-a6e3-e1a4fc8aab09", "comment": "Malware payload (Dridex)", "value": "8cae1536557cbe1e9d074a5685e7d5e9dc24adc0eb1b80efc162eef352a3d2cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758715, "uuid": "1bd2174a-33b7-4518-bc16-7f0fde52f307", "comment": "Malware payload (Dridex)", "value": "6769428282990728b3de3036256c603dc77dfc23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758715, "uuid": "cb0493a7-7260-4898-98a3-61735e7b97c4", "comment": "Malware payload (Dridex)", "value": "ad6173c1e3e5d1cb8f85ff34acfb6107df4ff4cbe3e49ffe18b60e94ec0dbfa478d4bf4a78a254c206059164c1ac2f73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758715, "uuid": "f733d852-2cd4-4a23-9bce-5b54ea606230", "value": "T1D483F11D048A20A5C5E1EE3ECB0E18F274966B576E04A98720CCB9788777157CF4F0AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758715, "uuid": "4414a04a-2e30-4979-92c4-2bac5c23f5be", "value": "1536:UWVPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hzudetI06cHcnO8zg7ymgdsR:VRqmc3/q0dfaguKyzudhxNnDkNgdsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758715, "uuid": "da9018db-45ba-40ba-b9ed-7fcfa8c29ba0", "value": 88216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758715, "uuid": "03061c54-a882-4401-a22f-5d0f05c2fdbf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758715, "uuid": "3f62808a-ec3d-409c-ae4b-28892fc1ec85", "value": "gift-coupon-94579654.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d6f98f-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637774888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774888, "uuid": "5aa2a7e0-a4bf-4638-bf7b-f2c2d25abb06", "comment": "Malware payload", "value": "bec9a0b991827a60dee4adf8869661d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774888, "uuid": "31acf6dd-0e96-447b-acb8-17c5eb381b54", "comment": "Malware payload", "value": "8d24cb395c89ad421360c1433ba82b33e7cb9524a0c39f5abfdc1acacde68a8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774888, "uuid": "10fd20a2-dea2-4e3f-938e-ff3359416013", "comment": "Malware payload", "value": "70fffe10b8970411748e29c3b1424d93027ad858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774888, "uuid": "5f4408be-3e72-4d16-8ad5-ebb96c39f4e3", "comment": "Malware payload", "value": "49740550a09757a68849d9b2e0c21c9239374bb25f673d06bfb8fb3ed5d7a85b06438f7f2f2ff2c4e6d7224251d0cfca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774888, "uuid": "ae50adfc-0aa6-463b-b79e-0e2331cbd642", "value": "T10FA3028EA5702D73F51009B6A36A590318F9BF5E257EEB4072098EC3F5A384E54BD3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774888, "uuid": "4fc19fab-47e1-4b96-8089-a8d1d601596f", "value": "21001cc8742b8f2a5e61bb4ae0e5d14b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774888, "uuid": "91764309-105d-423e-8c3e-10356c502c56", "value": "3072:3euVdGCEcMVqc+BnCqUyAWJmPF+bOdO9OL85YG7:3eu+CEcMVqTz+PF+EO955", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774888, "uuid": "0211e353-0c94-4b17-9615-d96b9025cbb8", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774888, "uuid": "937bf0c7-01c6-469b-ae60-727284ae1ab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774888, "uuid": "c5d279ca-7212-476c-b9f9-6b7e6413e368", "value": "bec9a0b991827a60dee4adf8869661d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c94f1e-4d1d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637754966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637754966, "uuid": "bdbbca3c-df32-4173-864a-4168c01b2655", "comment": "Malware payload", "value": "ee879ba2ab61f42bcfaf5085c392ce7a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637754966, "uuid": "50a1a0d4-cf72-43fa-bc8f-632b6ae0af5e", "comment": "Malware payload", "value": "8d7acd4c7f09d72abd17ef9c46585cace82f2d60e7ebd80b24a6969845c1f899", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637754966, "uuid": "4334571b-b74a-4940-b576-842c3684c0ab", "comment": "Malware payload", "value": "728e609b6ba64718d52caf848fb62de977dc78f0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637754966, "uuid": "e32abcbb-f51e-4d47-9b61-fb6ea2143952", "comment": "Malware payload", "value": "a4beafae2378b812daf34d1fbdd9cf20456d8ac0672d50c11cc4f9d5fa786a86bc3062faf1e828c0c28e9bc5dbbe45f9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637754966, "uuid": "73f21b45-bc4c-4aca-b9d6-af14feee6ae7", "value": "T14134222BF2192127E644093D2836A64A7F81DCB779709A6E36DFB709D4B221174E333D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637754966, "uuid": "e5202300-bc97-4cc7-ba76-dee006c6b036", "value": "6144:t6hYRBcVj8qjLKQp+zqFHEkRVC5nNX984YHuZ5qonyOi:QYRCVVZ/kMVeNN84YaFyOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637754966, "uuid": "08a8d350-6957-42d8-9dd6-834f21d4e16b", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637754966, "uuid": "73f7e6de-f5ba-4924-8f01-1cb1784210df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637754966, "uuid": "99d03e86-4c86-466c-8590-9f856f597cf3", "value": "zoro.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420f6b97-4d81-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637797809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797809, "uuid": "e2232428-aa34-4af0-abd2-d6c98b248a69", "comment": "Malware payload (Mirai)", "value": "9d234d3f54767056e8d5196e058c7180", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797809, "uuid": "1a569c62-7f77-42a8-ac16-6177bd54ad97", "comment": "Malware payload (Mirai)", "value": "8dcc6825ec6f43fd8aead90bfba952b3b0eb4ed5450ceb6d2703d770893e117f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797809, "uuid": "404bbc45-77ad-44f7-96b9-059f6e65b541", "comment": "Malware payload (Mirai)", "value": "d72314b4516b27c831436cfc57c92959a7144da3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797809, "uuid": "a9712ae3-76c8-451b-a7f8-9c2bbc5cc825", "comment": "Malware payload (Mirai)", "value": "e9c0ae27e920a85ab3cce6dace0f22afa0759f1526f5794ff6f381c8aaba4e6ec8a10c43c43e2f3820598bd60423e4db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797809, "uuid": "c550d9ca-91ef-40a6-926d-209574f1ada3", "value": "T124C2D154FDBC34FDE011F1B0A2B9D0ED3B78AC85D69A896806C49449343775A5F83EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797809, "uuid": "d821a560-758a-4533-b4a3-e16396758e97", "value": "384:MfNYm53OjDq+XV9rXihQ7JCLguqwyasZjr2pwyD/skn5Fj8bArE75S6O0oeE33sU:YLOv7XzX1u438/sknrIbwsolH3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637797809, "uuid": "6a3abfb2-4ea6-4d76-9a93-b2f56555d443", "value": 26368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637797809, "uuid": "086f2522-ee9e-42b1-b570-e16f3b4b5381", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797809, "uuid": "8601331d-efaf-4d66-a703-56e76ebc8c75", "value": "Akiru.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb62bfc-4d14-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637751042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751042, "uuid": "cbfa2ca9-1e03-4a49-9fb5-1cd6a993f917", "comment": "Malware payload (Formbook)", "value": "1a84232e14194f3ac154f8711d6f683e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751042, "uuid": "831a0c79-cfe6-43be-8a66-cbdc57feffc4", "comment": "Malware payload (Formbook)", "value": "8e405b6451c62462b5df1a0490175f4b9712ee1b1ab25a52f7e3a1f736400439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751042, "uuid": "a60dabef-1cbc-4744-a0c8-ee9e6867c84e", "comment": "Malware payload (Formbook)", "value": "c735848eb56e7fbfe229918de1e042c238edb1a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751042, "uuid": "f9a8540e-4c0a-4554-af63-c5687f6f04f1", "comment": "Malware payload (Formbook)", "value": "b459493e04c91ea0727ca979fc76a53a379dca13549b7712ae699bd686bbfbd0b8a798ded967f2ff6cb44f6164e02000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751042, "uuid": "2879db89-456a-4d0c-940d-48d01abdc150", "value": "T108B4F22436A0525AC6A53EF908A1118053727DA12A04D3DE6CFD774E6D327AFCF817AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751042, "uuid": "5a1b19fc-73c3-4fae-a23b-15142ac37c0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751042, "uuid": "e0ea0896-f001-4302-9ddb-19406e5efac8", "value": "12288:EAzTuIWYdamg7m1J6ZZk7xYqATZZdrFtg/Csd:9Txiecu7GqAVnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637751042, "uuid": "3c6db041-6ac5-4c1f-8429-462f4524c2cf", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637751042, "uuid": "78f062d6-d19e-4159-8406-a5a8d36d688f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751042, "uuid": "d6357bfa-9672-4ef5-a339-d6dce56e0839", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3c64fd-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637762769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762769, "uuid": "1de36973-5407-4bb3-a80c-9bcafd4b915a", "comment": "Malware payload (RemcosRAT)", "value": "4773e6ab30e76c810669bb1c80e18bff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762769, "uuid": "c43daf33-677d-4a1d-8551-6447c1ce0b36", "comment": "Malware payload (RemcosRAT)", "value": "8f3e10338b5fc52a4393b3cd0d8a519533f1c5056bbb5a9cc8f26842932ba8be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762769, "uuid": "e408b5f9-55c7-46e9-842c-2d7b22c11113", "comment": "Malware payload (RemcosRAT)", "value": "42534f0fc4f336a4fa215bd1a3c847e799ea2d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762769, "uuid": "404e7892-1097-41e5-add6-c618396bbaba", "comment": "Malware payload (RemcosRAT)", "value": "49bab72dd2623d367aad3b0636af12201e5e2856228ceb45ed8f1acebb0f74b97bdd29c4305bff07c72fbef45b7fe738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762769, "uuid": "c6a238f0-bea1-4b80-a8e6-304879e86719", "value": "T19AC423F7A52405FAD8E25DF38577A64441B29EF981E0154F9B48BF343EB3213C07A8A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762769, "uuid": "43bcfaba-f2c7-460b-b640-ef1962690b52", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762769, "uuid": "3dc1194e-f9a9-4438-87bd-740e4d138ee2", "value": "12288:Gy17E/iPsjyBYoO0HwJyj/S75/B6WbR2KNYV2wi84v61:GlMselcyjiB6WV2KkN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762769, "uuid": "82ff919a-5519-4686-9de2-ca605320ba60", "value": 555325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762769, "uuid": "6e2c690c-312e-4a99-8a1f-3a56aaac93b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762769, "uuid": "71b92ba6-27d4-437a-9b01-5a7b89132025", "value": "\uc6b0\ub9ac\uc758 \uc0c8\ub85c\uc6b4 \uc8fc\ubb38\uc744 \uc778\uc6a9\ud558\uc2ed\uc2dc\uc624_H7790,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ab4263-4cc8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637718326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718326, "uuid": "7cc8a4ac-3598-4a26-9311-096315c16cc3", "comment": "Malware payload (RedLineStealer)", "value": "d45a44e77cd279af265f322c33795e14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718326, "uuid": "25237604-bf3e-4fbe-847a-bb4cbdd387ab", "comment": "Malware payload (RedLineStealer)", "value": "8f89e87031d8f92f9c4dddd69d8b554378c73690fd01af96c22dd0065d2d90cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718326, "uuid": "deb013ea-a891-4f9c-bfd7-06c7cbbd8519", "comment": "Malware payload (RedLineStealer)", "value": "fed067c4b235989d3dfa9b19d6c1348b04474c67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718326, "uuid": "c1965b94-6ff9-497f-a716-816fbbbe1dc3", "comment": "Malware payload (RedLineStealer)", "value": "69c1700cfbcf206a50b672d43b50dfbf941af51d690d898858c2ec893fcc6ee9de91b2886c10bd83314dff9113625abb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718326, "uuid": "938738e5-d707-4a0b-9cb0-0c6470e439a5", "value": "T14794C000BBE0D039F5B716B9A9B58374693FBDA1AB3490CB12D026EE96396D0DC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718326, "uuid": "9f64734b-777d-46af-9782-780ef382a0d2", "value": "227bb68f00c01d84de5b7cf57cce44af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718326, "uuid": "451bc9bc-b2dd-47a4-bba2-fc8d2e8aadf8", "value": "6144:WG/p4EnpqMUYSqarWJ+WDmutEMi0vSLpDLEdFqXhiXAavJM+yyp+Y:WOpFnpzSqarxbuteDpfmFqXh0RM+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637718326, "uuid": "54068da2-9c70-48a9-835e-7f5b9ccd5f65", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637718326, "uuid": "e3d21a7f-fd17-4d1d-8e74-71cb9aaa4757", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718326, "uuid": "ed6ad419-897a-456b-8fb1-7e683d737833", "value": "d45a44e77cd279af265f322c33795e14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85af327b-4cff-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637742088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742088, "uuid": "3dc6ec79-ec43-4135-bc37-993348325194", "comment": "Malware payload (Gafgyt)", "value": "a03e51ddbbeb9144509b3cd3532afa41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742088, "uuid": "fe0c6c54-e3c0-4a0b-bacc-60f35eb36a00", "comment": "Malware payload (Gafgyt)", "value": "8f9a09a76ebd857353401ebb740f18e594829c1e5524c5692440f126a3f6b9fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742088, "uuid": "b4514b2b-5d75-465b-8927-aa4aaed8b976", "comment": "Malware payload (Gafgyt)", "value": "c56dc3595ce88b417df17180821392b6e2c317d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742088, "uuid": "c872efb7-48eb-47e3-8260-f62a230e0c23", "comment": "Malware payload (Gafgyt)", "value": "176c3fd6e259ab57e28c249b5109836a66a94da083368a1d25c2e6ce7eb0c1e1d858431cbf67f4e2db2bbe638f79d066", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742088, "uuid": "f207b63a-c99f-48bf-a13c-c2e487e3bb61", "value": "T1DEA32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742088, "uuid": "a60ab16a-cdfa-4aac-a0f5-90fb1e5a9d76", "value": "3072:7e9h9oZQ5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZQ5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742088, "uuid": "aca7e64b-a0f4-4051-9f70-e8141a082266", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742088, "uuid": "e4e3ad3e-1fbc-467a-aa9f-18aa88d49e43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742088, "uuid": "58258ded-395c-46e9-b0e8-66964b8f7f63", "value": "a03e51ddbbeb9144509b3cd3532afa41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3753e63e-4d59-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637780611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780611, "uuid": "06bfba9d-07fc-42d9-9b1a-a02ec3e1dd55", "comment": "Malware payload (Heodo)", "value": "2a23c7060a6c534c3945a65afa01f760", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780611, "uuid": "6233d2d5-2209-4eb6-bedb-1baf2c74f088", "comment": "Malware payload (Heodo)", "value": "9200195b79f0c188cf62282ec199b8d0733a2efbf39590737c3fcc065489e19c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780611, "uuid": "252c57e4-f795-49f7-aaf6-ca5af9afa3dd", "comment": "Malware payload (Heodo)", "value": "b1ff600aee22d8efb794e58ef31972a32a7160ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780611, "uuid": "48f2b26a-e784-4922-802c-251f297547d5", "comment": "Malware payload (Heodo)", "value": "dc03da335a8d50dfd8ff9df5f214c82eddebdf0cc5bcdcb4835d792a2474e3c2580a8b06d86f75f757e7e76dcd0d31c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780611, "uuid": "56bd22e3-f7aa-4cf7-bc79-e319900228f9", "value": "T1A5C4AE02F292C57AE2AD15346E627B34F7F8FC504E75CA83EB81DA1D5E376818A35321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780611, "uuid": "843fad0b-4701-41c3-98b2-1eafc4e47dd1", "value": "286789ad96f1473976b8652196abdc09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780611, "uuid": "298aa9a3-f836-44f2-b0ed-5dc49c23d328", "value": "12288:ozw+tQuqbHk2QSR6GT0SZKOBgQynCMCn/vcTPd2OWg:UtlqbHFBT0SZjgQ2h4/vuPd2Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780611, "uuid": "005907d0-4ec1-41cd-bd05-bf6cecee1572", "value": 573517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780611, "uuid": "e9feffe3-c734-419a-b6ee-36c2fbba24a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780611, "uuid": "945758fd-a067-4902-be39-064469b8bf9f", "value": "emotet_exe_e5_9200195b79f0c188cf62282ec199b8d0733a2efbf39590737c3fcc065489e19c_2021-11-24__190326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f912b6-4d2a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637760525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760525, "uuid": "bc95b9ab-2b12-430b-8040-4e061b13c7a0", "comment": "Malware payload (Formbook)", "value": "25ff5f4c25cdad26f97e5be57e49fcd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760525, "uuid": "70a42450-e9bb-4369-96f7-bd9e3c90dfdc", "comment": "Malware payload (Formbook)", "value": "9230d02930c2f2c7426b24a9783bfbd80261d152895d15767f8c0f25c21a1409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760525, "uuid": "b5be92ac-94dd-4bc9-a677-42060dc9a0e7", "comment": "Malware payload (Formbook)", "value": "61ecc1dc45785c8cd0263c561ebd5745e5892dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760525, "uuid": "9b9f66dd-1929-43f5-99fc-313fd19c1c68", "comment": "Malware payload (Formbook)", "value": "dc3f1a4b348fcfb80646d6dcb4af51b1cef683dbf2bbb25ba2d6d5b7a90242a270a6ce999072be68a2a1a05d9cbeb73c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760525, "uuid": "6f8dd995-fde9-45c7-95ea-cb6c917c49b5", "value": "T1B664138B7AC0EBB7E8730A7219FAE376D7B2279053618CB797D81E560E1D40F06052A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760525, "uuid": "0b78affb-6125-4ebf-a556-f9322eb255b7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760525, "uuid": "7d7afa41-3af7-45a1-9cb7-d92792180e19", "value": "6144:rGixS4AzYzzm/Za5DlhegMIUxkLUqq0iwNea5I0jXQxQiiAbw:Xnzm4h4zDJVwgGhTQxbiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637760525, "uuid": "be55630b-6c53-4c13-a842-13963dfb8759", "value": 320403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637760525, "uuid": "92a3d3ee-1904-4b59-b492-de5d628a7894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760525, "uuid": "7f222b99-fb6e-4a28-974a-cf443a9fffe2", "value": "WAK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a52ad6-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744455, "uuid": "3e8fd8db-e44f-4336-9bb6-4ef839ade6f5", "comment": "Malware payload", "value": "00b1897caf4942167c3b8f4c920aba31", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744455, "uuid": "9ffa2327-5e1a-4b4f-ae1f-162b3e24ad02", "comment": "Malware payload", "value": "9280671861816d70f67c5b2bf75ce02d8a3c141453f61071313a512ec0089b57", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744455, "uuid": "73fb8c1e-2863-46af-b636-1c79adf489bd", "comment": "Malware payload", "value": "b467d9684ab49ea4e2812949c98487ee939be0a9", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744455, "uuid": "9460a4e3-9a49-410f-bc3a-c80a233c7035", "comment": "Malware payload", "value": "07b71b00d52efd1b0c9832d8bf6d46e3d138be8ed28163c0b06dc4669a651083c16b14321df75415f8fefc081b468675", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744455, "uuid": "f24043f8-02ab-4445-876b-47d5fc4b8441", "value": "T199B5330C1375B8FDFC5E412937634ED0C2B9A2E4F94261A192684CA85D3F5BE13EF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744455, "uuid": "1ece4161-295c-4b40-8b63-8d190c06d24e", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprW:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744455, "uuid": "082d023a-58d1-4d06-886d-44c7b209bd0b", "value": 2363392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744455, "uuid": "86e24d50-f82e-4325-8e8e-2db89175842d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744455, "uuid": "ef3e2414-d4ae-4422-b015-6d8f02fa7b7a", "value": "9280671861816d70f67c5b2bf75ce02d8a3c141453f61071313a512ec0089b57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60396d2-4d2a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637760664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760664, "uuid": "686f4c0c-6c5c-4c8a-9814-5ffc3f88e157", "comment": "Malware payload (Loki)", "value": "fadf7e273646fc3dff3d64b1d4b1ff87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760664, "uuid": "6f5b35a2-b709-4430-85ac-7c08dca737ce", "comment": "Malware payload (Loki)", "value": "938e81f2b036ef6ec86fb7ad3a5c1b483ba97b018d78b760940e12411cad4b14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760664, "uuid": "4bffea4e-fc09-4226-8c17-2904ed856ac3", "comment": "Malware payload (Loki)", "value": "d2a6c0f269806caf40c0c53d4a02694ad7a89b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760664, "uuid": "7bbe17a4-6346-4eeb-b344-4bc532d4f0b0", "comment": "Malware payload (Loki)", "value": "263cded64018c8a68ab7eae9ff130750997b231684eec9e5aee9669d7ace53edb3c948660c4c8dd2c35fa0da0cf53600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760664, "uuid": "9ea55df5-34a7-45b2-ba2e-ceddcb0b38e0", "value": "T1F9A4F1553398B793DC7A5BF50C3290C1137271167804EB2EACCA72CE2D26B1A5B16BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760664, "uuid": "361e8ff7-346e-44f5-9890-f7b3c4aa20aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760664, "uuid": "c0bdf008-e3dc-424a-9871-4b0749ef9295", "value": "12288:FtD00Ze4C6iy9XDYOdoLCD34ajkeNJdkx7++ZVAKiVbEq:FC0i6iydcOd3b4e6E+vCVbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637760664, "uuid": "73243dc1-2c36-400e-b3e1-80b87034096f", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637760664, "uuid": "4abcd87b-c50f-4ffa-8785-5f1b17aa4ce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760664, "uuid": "0b10d7d6-51c9-4961-a613-90f4af8b4221", "value": "PAGO TT (Ref 0180066743)pdff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad605ccc-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637762770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762770, "uuid": "10afb452-16c5-4c06-b1ab-53db6e8a0eda", "comment": "Malware payload", "value": "025ac5a046659221f1aabc4f69d19f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762770, "uuid": "b8021032-2688-4469-83f1-b1f09379a802", "comment": "Malware payload", "value": "93bddd58c1a33efb1dbceca2ce81778a84565e48439fc0907d13f0b07930847c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762770, "uuid": "91f7c1c2-ec3d-43fe-b836-fa640eccdea9", "comment": "Malware payload", "value": "a357bf366ade5bc70040f94c7a23ec1239a1e450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762770, "uuid": "57ae6160-aa97-4887-80aa-411b115f583b", "comment": "Malware payload", "value": "c4315f710855fa774b3119f095676b2d6a641a898e5da011935da4cf0f2219f57fba90f593a9408c657d9a4ee5a34a4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762770, "uuid": "9c13ad29-941e-47ce-bc73-9259a5f20f47", "value": "T12563D00BB8C0A9BBD5830B715177B77EF3BB9258055148538BA02FBF2D6168382177D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762770, "uuid": "f934a645-d3f5-4a33-9f74-b862aad6089b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762770, "uuid": "0b3f03c0-4e5b-4530-9ebd-725db30c9322", "value": "1536:YYTmwVUsW7dtJMHy0DxmJJdW/G1Ep1yyFi0t:rS17XJiDxmJJdW/Pp1yyVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762770, "uuid": "febc495c-3d2f-43e8-996c-bb440924fdc1", "value": 67831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762770, "uuid": "d6807ab8-5fd8-4883-858d-1dd677067c15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762770, "uuid": "1160413a-4cba-4c0d-8e53-181ceb794f58", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e73c583-4d21-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637756598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756598, "uuid": "a7c7a24d-9c75-419e-9d54-f876a03247f3", "comment": "Malware payload (AgentTesla)", "value": "f5cf1496c1ffb8a64488b21a90c78f9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756598, "uuid": "0dd3f719-a34a-4210-a71e-947af588badf", "comment": "Malware payload (AgentTesla)", "value": "93e040a201649f11154c8317f1a2f29d53a42103a743b417bff28d4283ddcc54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756598, "uuid": "ba921d1b-4184-44e1-9030-a5d28c3a1d71", "comment": "Malware payload (AgentTesla)", "value": "797a32af2ae1f5bb2d350d22c878f33224b505ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756598, "uuid": "b4652896-f3de-4269-9db6-07c6005945ff", "comment": "Malware payload (AgentTesla)", "value": "f24b1a8e9dafbd605775b17f31f5b130dd192159384ee189c7075ec33053fe5cf1e4e2a98c20902d96d0c55ddd17ab08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756598, "uuid": "213f2476-e613-4c69-9162-492242127cef", "value": "T1A9D401283A57A893E0292276C99B514403347A4936A3E36F78EE335E25117F76F14BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756598, "uuid": "b91fb41a-dfd5-46a8-9d94-e1abb605e3ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756598, "uuid": "a22c4b20-ad80-4ecf-9112-611213dbce26", "value": "12288:185PaaaYcdrJ0yaOn8kOHbV3m8LTQq9ON5Kz6Y39kfZebUypTew:EcdGyPRWbV3zoq9ON0zXuZTUTew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756598, "uuid": "2446e5a7-18f9-4ebf-be4f-115ac9240016", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756598, "uuid": "65dad86d-99de-4f9b-996f-28019fc2cd11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756598, "uuid": "bf296ff2-8287-41ef-905a-130219b23d62", "value": "RFQ-110146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439731fa-4d81-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637797812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797812, "uuid": "1f75c7a2-15be-44df-aa70-311b4c11de33", "comment": "Malware payload (Mirai)", "value": "590aff5bb9e52fb6455c2da894819509", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797812, "uuid": "de81622f-d4bc-4809-b804-d30dc3aa5c44", "comment": "Malware payload (Mirai)", "value": "94d0f251ff7f0c8420d3c7de2022bee3629e86ea63cf10fbb5aeb64a41a09fe9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797812, "uuid": "2733edac-74f1-4374-8c5a-fc4555b22e38", "comment": "Malware payload (Mirai)", "value": "7c9abc2174880aadc40480966a8b25f7af1b6985", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637797812, "uuid": "e663b721-b15d-4c88-8abd-984281c4db54", "comment": "Malware payload (Mirai)", "value": "4c1cb1c16ba2387ea196c7c2aa6b7c814e98a0d1aef34aa675096d6f9619124853eeaf485be9e903f2fbb8afaa0924f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797812, "uuid": "bcc82000-7627-4bda-bafc-d97597a205aa", "value": "T147C2D050A1250E61CEF0503DEB7DC5477E0B32ECF19EF27F790455141BC28AB92BA14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797812, "uuid": "110b5271-4fca-436f-865a-a82717835620", "value": "768:RaNKktP4WgEXVkrwDPU0v/b7UCbs3UozXb:IP4jiywDM0fUdzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637797812, "uuid": "920e97fd-82ac-43fd-800c-306fe5f105b5", "value": 26424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637797812, "uuid": "1c365c16-326d-46b0-9064-790c7ac64066", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637797812, "uuid": "585a9d94-e783-4443-a36d-c645ac42abf0", "value": "Akiru.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3cb4ce-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637776054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776054, "uuid": "76ad9666-e697-45b8-b5b2-393d462e9b8d", "comment": "Malware payload (Formbook)", "value": "a4fc3513e165f8c4a18fc42f60698fda", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776054, "uuid": "141e470d-46c9-4602-bfb6-ca2a5f4860f7", "comment": "Malware payload (Formbook)", "value": "94fd32fdbc89d8401d37aaedb27747c710f2733da14b8df9396ae55f8db0bdad", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776054, "uuid": "bd72105e-e62c-4f77-abe4-cb04dccb022d", "comment": "Malware payload (Formbook)", "value": "0bad1dd33712c088697bc2d4f58746d6409744cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776054, "uuid": "1acd0c06-2b11-466e-af8d-94332513b1ed", "comment": "Malware payload (Formbook)", "value": "f1b99eb81a80ad46e11e61b8ca8a2e8f006831b6f59c48dba676c11a454592a9daa530f425e1a7f03f2fd7c5e3b9ce65", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776054, "uuid": "c9831579-a8c4-46b3-b8a0-ddbd1beaae6f", "value": "T1863412B43323C61AEEBD6B314C73DD5850E8ED15F4993202F81B7E7BE23D49A50A5A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776054, "uuid": "515acb48-c3e1-41c4-8ea6-44fff9c4dff8", "value": "6144:h13s6Vg/nsjvJrypbH4RBUF8yyURmfu/N:vs6Un5pDYYlh6u/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776054, "uuid": "66e60f4f-87e9-4c43-87f0-c8cda5465e06", "value": 234488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776054, "uuid": "e8e2c381-edd2-4928-8c29-35b48be67d46", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776054, "uuid": "cdd2abad-5d85-40ef-9574-4a8630b714fb", "value": "IAENMAI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed36b28-4d00-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637742452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742452, "uuid": "b9a58765-ad7b-49e1-857e-a75f3ba16a21", "comment": "Malware payload (Formbook)", "value": "0ef87099ea49164fc1dd5999763c6b19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742452, "uuid": "7a453bc3-ff3c-418b-a085-0635ec7eece6", "comment": "Malware payload (Formbook)", "value": "96a065bd6726b198e2cb2723f6eacee3f16ec1b7925c97547db30aa2eec00c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742452, "uuid": "597f8dcf-53b3-4848-881b-c048ec90a7a7", "comment": "Malware payload (Formbook)", "value": "1d7e88dd09c5406c52fbf1e55eaade3c89b300f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742452, "uuid": "c726a841-56a4-4942-8d6f-37ff6cb63282", "comment": "Malware payload (Formbook)", "value": "a8e4bb02c28530f970924da64662f35dc6a09aec9b5fc34b39e7d238191ad79f4d549f634b82667cc5c2fdd9ede52606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742452, "uuid": "05535f9d-24a8-4e44-844e-bfc7452fdf7f", "value": "T110642311AAC15B77D287A1B042F2BB3ED3B36BD146F14A03AB491F6D3CB105782562DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742452, "uuid": "cdb7b867-182b-40bc-b1cf-52ba11a09135", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742452, "uuid": "ed72d62d-68dd-4935-88fc-e5fb5232e400", "value": "6144:rGigiZL22i9/KGU7BnirnZ+aFRfg/3JJPMZP4K3RihqA+9i:q9/K3nSFBghJPMZP/BuqRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742452, "uuid": "e1116b25-ffa9-4172-9e9d-0a2859f1509a", "value": 315642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742452, "uuid": "364eddae-55f3-4277-b443-8aedf9342192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742452, "uuid": "0b83a261-3f98-4607-b726-77138f5d417c", "value": "ORDER K0-9110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0431b3-4d68-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637787008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787008, "uuid": "61be26c6-ec11-4a00-8fdf-d63a523aeab0", "comment": "Malware payload", "value": "09517f747f203438c62ce80c6f516a9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787008, "uuid": "044b9797-4016-42f3-b4a9-76d4c91f6758", "comment": "Malware payload", "value": "96ae9311ddb7331dddd8588cf535ef5ddb576c5f08dbde74d526508adca0e01e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787008, "uuid": "4e0b347b-116c-4eb9-aab6-c250b5667613", "comment": "Malware payload", "value": "35b4eb255b8e69e0c8f4c44ebce86bb747da9147", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787008, "uuid": "f5b8aa4f-9ec8-4be7-be6e-73ca1faeb776", "comment": "Malware payload", "value": "b1854054e9fd4b2cb0e9ae9dd201e8053faa80f22dd0327118cfd5a0edaf0bd27174b9567d9bf0951c5f573a4c24f8ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787008, "uuid": "285c2e58-e45b-4177-aed3-273323558c4e", "value": "T1E553E751BC915A6AC6D063BAF6AE10CE3321A3E8D1DF3217CC105B157BCA91F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787008, "uuid": "d2b18dfe-60f4-4851-9c56-095f43030bc2", "value": "1536:wqZBtAcv4wkjbTokvCrndPHmNtGpBLoh+iKaFO:wqZBpqNSuUBMhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637787008, "uuid": "6519a2d7-d870-441c-ae26-79f85d56268b", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637787008, "uuid": "eda22106-9bc6-4116-a7da-2b551fd0cc98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787008, "uuid": "383f1867-77dd-418b-8acb-632c01951c71", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84049804-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637776015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776015, "uuid": "958d80b8-b69d-4bd0-8a66-b0f14b0da69e", "comment": "Malware payload (Formbook)", "value": "2c0209043363d64662d9e8848c8a4d6a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776015, "uuid": "b742fe83-827f-498b-bbbb-fea0514d2890", "comment": "Malware payload (Formbook)", "value": "96ff7f066d5f24a270bc71d56b791261a82ba072d2b3fd2292de082840326da6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776015, "uuid": "89a48965-04ad-4d19-b3bf-e09fd4a691eb", "comment": "Malware payload (Formbook)", "value": "18d7bc357364e3f9f324c2fd1018ce2a17056aa8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776015, "uuid": "68c81aad-33f3-4f04-bbc0-a8101275e868", "comment": "Malware payload (Formbook)", "value": "a6d6c5a1cfb192d5aadbe41fb51260503dd6cdbd75a097b5e672d20fc9eefd29b1a1cef06026287708357278faaf82e0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776015, "uuid": "5edb88d1-b056-45ae-ac84-f852d287c3a5", "value": "T1C934129EFE3B0479DB22BEB7848F1E876A54CD4BD12D53691014B05924B3A0BC9FA533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776015, "uuid": "968d33f9-8baa-482e-9161-21ce50815de9", "value": "6144:3wiwKLQHHd7E3ckCCqH2abAmYq2WdOYe0QZA:AhKsnSsbvX1YbWdunA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776015, "uuid": "18d57212-b746-4de9-b04e-843623f1e925", "value": 234680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776015, "uuid": "689211f2-3604-4c5e-8b5b-a3d907406f09", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776015, "uuid": "b4828993-a3d6-4083-82a6-4d078ffa2a7a", "value": "xF3wienie.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb4d21c-4d2d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637761888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761888, "uuid": "ee7802f9-0518-4ebf-a179-c7f1bc3bdda3", "comment": "Malware payload", "value": "4715e7d6b18d8f50af1965867b2bb14f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761888, "uuid": "efa112c6-b40e-4d19-9349-0e015ac7802f", "comment": "Malware payload", "value": "97021cfe9acaa2ac1f9fb5a42f108aec3e566b014aea52ef12ed3e446f93f669", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761888, "uuid": "743ea118-0b34-4286-865e-71b3fa8dbe3e", "comment": "Malware payload", "value": "1a113863b57da1f6c1c204add25f3def619de6f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761888, "uuid": "8a5e01b4-0aac-494d-893e-ed8b4d007ffa", "comment": "Malware payload", "value": "c77afda64083a411b55d1c47a3ebdfa7def3c3c850ab1e3959ab7ed7adc06e3ba5ee144e7332564a0ca706cb76077ba4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761888, "uuid": "76ad8d26-f5d5-4bf6-8def-9419648d33d6", "value": "T1F0E4CF7DC44E90F2D2F1E1B4ECBAD873386A7562030ADC4497AF611B0D560EABD88F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761888, "uuid": "f25285e0-515a-4674-bd92-2e2cb2cbd21d", "value": "971db54a536c0afb2a1a128bed832589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761888, "uuid": "49bf401c-20e4-411b-8a09-0fe4f11f45c6", "value": "12288:bYmlcs0ImQBwAYOtRvpjU1nm1bP5OeW3G4Gmczvm0GD21W9ntSa:dcuTmAYOvvDpPke5lzvms1sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637761888, "uuid": "89b0c953-5340-47dd-877b-f566de536204", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637761888, "uuid": "56d24442-1395-476d-88f0-9fe73f1553b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761888, "uuid": "f43cea69-235f-42b1-a7eb-48d2badf27f8", "value": "1a113863b57da1f6c1c204add25f3def619de6f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0352f1-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637780404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780404, "uuid": "ebbaafd4-105a-45a8-86fa-ab8760dc29e8", "comment": "Malware payload (Smoke Loader)", "value": "64521712f41eb0195cdd7ad9851b03b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780404, "uuid": "2e6aea6f-d394-4dd1-90a0-d1d577fc0c88", "comment": "Malware payload (Smoke Loader)", "value": "97f7186a521996a1bc819e88a1c964fa4452a2cea7a1ce0a59ab267a7750ad08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780404, "uuid": "fb210aa1-1f7d-4ab8-ae17-e2a5f9301a75", "comment": "Malware payload (Smoke Loader)", "value": "8b9f580e633f7fdc1b3bad2a099d0c942dc60bce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780404, "uuid": "8b01bede-af78-4ba6-94a6-55ac22c056eb", "comment": "Malware payload (Smoke Loader)", "value": "6c0293559a47dd64a2e384bc29e6540514b56ffc526f614000be103d9326d620210f4db1d73e51ae5069c8a41da42aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780404, "uuid": "3aab8cb3-3aa4-47f1-9c8a-248e1e8b3587", "value": "T101E3BFE032E0C033D167153028B1AA751EFAB873167E414BE7A8226F1F712F15AA539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780404, "uuid": "4a34c282-17d6-4c97-86f2-c5bfb02c2757", "value": "bf61ae69989d1072f08e18d6fa6b3469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780404, "uuid": "e31353f2-c2fe-4812-9155-3d125aa2ccdb", "value": "3072:B+oemgaoSit+078Q1TSru5vDbq9Gu/Rx+IP9O2:23aI+078QU653qC6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780404, "uuid": "4b78ca06-0f59-413a-8a06-b067833c8078", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780404, "uuid": "a1deaf07-1104-4fe1-9f36-7b503a401b8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780404, "uuid": "bfc5a8e5-13df-4fd1-a9ac-538711774356", "value": "64521712f41eb0195cdd7ad9851b03b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92fc97e-4d62-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637784802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784802, "uuid": "b8f5303e-3cec-4b5e-9ef2-038118b1f3ea", "comment": "Malware payload", "value": "6abfe7fba964f62b4272f1953198ade7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784802, "uuid": "216359fd-00e4-455b-8660-c4d96378be79", "comment": "Malware payload", "value": "9920bb4ffa12cd65cd2719b7933cb51894916dc2d33a533a5b2207480ea2102c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784802, "uuid": "7cd7becc-866e-42fa-b290-357411e65231", "comment": "Malware payload", "value": "c25b84a65882599ff1ed96b85e28d712dd38f3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784802, "uuid": "a54d98d7-79de-4e75-8ea0-d63e2d705569", "comment": "Malware payload", "value": "e3cbaccbc12c869ffc82222448f969fe41e0a49478217fa11cf58276e4e8499f7f59535fc36cebd8364fd5695cc66de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784802, "uuid": "79a62549-93cb-45e3-ae52-809b1a278296", "value": "T1DD46338274482BEEF9082478D89E2432C7960E2534CD5FA4AB2F771F62E34A7935F45D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784802, "uuid": "ec551b9e-bd3f-41cc-a9fb-09d236549f56", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784802, "uuid": "9ecf91f3-9579-42ce-afaf-1d4c03e6915d", "value": "98304:8WQGN9lpFEc+LgLgLdaZzUlq4k4h+IwvEziIy:TNDbEc+c8aSlA4kTHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784802, "uuid": "216dcbfc-c502-460b-b14f-03240aaa40e4", "value": 5509632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784802, "uuid": "edd886f7-ea34-46aa-a686-bc42e86e774d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784802, "uuid": "03d7efe4-3920-4172-bcfd-a4b387c41428", "value": "6abfe7fba964f62b4272f1953198ade7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f30557-4d32-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637763778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763778, "uuid": "ec8300cb-fe06-4add-a643-7595a1fde43f", "comment": "Malware payload (AgentTesla)", "value": "1742e2a816889c636b54358ad85b2533", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763778, "uuid": "a48ccf43-19a2-41a5-a084-1a325907e7a5", "comment": "Malware payload (AgentTesla)", "value": "998721891ea36ecf8c6a6851b83eb5a9b53cc3ed1cb87080286aa7c14a00963a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763778, "uuid": "eee928f3-bac5-4764-9083-0114016b8ad1", "comment": "Malware payload (AgentTesla)", "value": "00cd412328fab92d070f88ebe4b562825b90a261", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763778, "uuid": "610d68cf-7c24-46e1-ba45-ccccbb9c27cc", "comment": "Malware payload (AgentTesla)", "value": "69ea7bd3758266ade47feb101e71a027e76e2ee67dc1eed189b7e64d04eb9fb6b1a9d84e69411071abf77007015839e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763778, "uuid": "87a12af4-7182-4e53-8836-e7b214956d0d", "value": "T1BA94013136E9A32BCCB74BF50C54A2882372B2057E15D75D6CC462DF2E22F568B12B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763778, "uuid": "465974c5-e212-4418-83b5-a98e5eee5133", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763778, "uuid": "a534979b-17a7-4bc8-b11a-5ac9d9ab48e0", "value": "12288:RTMPDvJD3E3X8fOJoIA5mXfWF6UCNc7E:tMlE3XwpqWbCN4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763778, "uuid": "7fc5c35d-a3e8-4adf-a632-fd3ac39fdc2c", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763778, "uuid": "59269528-3e80-4823-8b70-77a588fe9eb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763778, "uuid": "1b5144dd-bb1f-4def-8c6b-460e7bd9a780", "value": "Hsbc swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2736f98f-4cf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637736776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736776, "uuid": "85f512f5-af10-4340-b44b-87b8681696df", "comment": "Malware payload (Formbook)", "value": "3e267945b34aff0e99a9f5b257f91535", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736776, "uuid": "f7aa061d-76a5-417e-87cc-755abb0c2d24", "comment": "Malware payload (Formbook)", "value": "99a6f98695b45613bd04d32608f4d53897eaeb7e010d5137908185e97fb32a26", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736776, "uuid": "1b3a1f0f-eb6d-40e6-bc04-eb89e68eeef7", "comment": "Malware payload (Formbook)", "value": "4ba90b9d12317f0797cb5f34e9f23d9a0b2fd529", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736776, "uuid": "585eb95a-5bbd-4d07-97e0-0cbef6a6409c", "comment": "Malware payload (Formbook)", "value": "81e362cb441507982178e4c0265b78aab2e21909d9795001d155f1e99dfadfa9325a83205fb8c872803a643eb17d6082", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736776, "uuid": "e15243fc-38ff-41b8-b9e4-815a59f96999", "value": "T19284236C55BF9CE204AA7C74CF8F3EA8BD2CC9104EC67C256A51D8A06CA779425E9309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736776, "uuid": "9e88c540-317a-4e62-9b49-86ead6ee981e", "value": "6144:DF6XhQouMnSQBkl/PaAntNu5aXqdPPU0k7jLyU2v6BN8AQWioHR00Isz97rHH3AX:xDouMnNqnBnfVqdP87jLyRv6b8RWigGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736776, "uuid": "18564d85-a18c-42d9-a723-ac269a7ce022", "value": 371260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736776, "uuid": "850c4895-3b64-45c9-9fb2-f85ec4eb1619", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736776, "uuid": "290a6548-5f35-4d97-94a7-4ab87e006e50", "value": "DHL - WAYBILL 44 7611 9546 - Joao Carlos.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70b2681-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774410, "uuid": "62940590-790b-4d11-b566-f5d042c10c33", "comment": "Malware payload (SnakeKeylogger)", "value": "f49d71398e878ff3361f02e0ee5f3231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774410, "uuid": "78a1986d-866b-4b8f-972a-23126d2f433f", "comment": "Malware payload (SnakeKeylogger)", "value": "9ab36ecf0d3389444a0afb86c2664f4811b327e691abd8112da26c5dd3941a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774410, "uuid": "e2b1f417-94d1-401c-a66d-434b2514a09e", "comment": "Malware payload (SnakeKeylogger)", "value": "36ee01c360e6d12d6631ec690b43dc257c7f822f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774410, "uuid": "d9dc21f7-b1ad-4f9c-b62a-a11fea99b295", "comment": "Malware payload (SnakeKeylogger)", "value": "075614987fc4e9f8ab4c6685f308b2a64dd1760635119b5e02ebf2eeca9493fadafa46b6773a6b2a03376793f82d6066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774410, "uuid": "d6354f45-6bc2-4b91-80f0-508f784398fa", "value": "T1A51512203354BBA3C83257F10E71D0E0537665A62514E76C6DCA62DE3A32F069762BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774410, "uuid": "c0822459-aa1e-4802-8be8-da7b3979824a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774410, "uuid": "95fa92ad-bb8c-475f-9a84-9c3f3ea6530a", "value": "12288:stD00mlNXbG4OTwQr6d/1Iwol72+4+NHoJRGzimGva7UkPevv/c:sC0mlNX3OTwJEn72+5HORG9Gbkuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774410, "uuid": "46e334a6-af28-4a89-b1f4-cd1f135b92e8", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774410, "uuid": "195bc515-a396-40eb-8339-83262dd02cda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774410, "uuid": "62c06fba-3fd5-44aa-a8ff-1b925e7706ab", "value": "24567987652CHgs6c19i75tP6g06543456780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099d87f7-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744457, "uuid": "e5c9e51d-5219-474f-a64e-a3267dde155d", "comment": "Malware payload", "value": "44992c76297d661e896f98d3c80bab49", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744457, "uuid": "8484ce41-c2c1-4301-a7ce-1d0357678a34", "comment": "Malware payload", "value": "9abeedafd3eeee16178be2166707c8ff2086e8d3e25d1df18d925d3056e7084c", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744457, "uuid": "c37e9629-53b6-4ebf-92d8-da355a6da593", "comment": "Malware payload", "value": "35baa91943180a5ccd2883bd4d3919dd8de6cb2f", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744457, "uuid": "ec831440-72e2-448f-8c61-00e37c1ce535", "comment": "Malware payload", "value": "dd6f7989661c986da5932f0b944c889fe52f0d98b957ad2c8102ecad498c65f38c5857fe51b5f6db13d2e06c4b2374e6", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744457, "uuid": "f9f587d6-cd6b-4543-9f61-2a447d480e9a", "value": "T1FEB5330C1276BCFCFC5E412927634ED0C2F9A2E5F542619292684CA85D3F5BE13EE972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744457, "uuid": "396e6dff-9fe7-4846-a589-ea7e9b9bdb2d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lfprk:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744457, "uuid": "925b8f76-8121-4935-bbe1-0e36f0c10afc", "value": 2342912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744457, "uuid": "429eac4e-9f34-4a2c-844b-85cee25eb8f0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744457, "uuid": "c14a4edb-64e2-4491-9838-facd0fd4f57e", "value": "9abeedafd3eeee16178be2166707c8ff2086e8d3e25d1df18d925d3056e7084c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689483fd-4cd0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637721853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721853, "uuid": "747edd30-51a7-4113-9a28-c15b774f73b9", "comment": "Malware payload (Mirai)", "value": "ab97277fd974a2e139047d3f28cf108b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721853, "uuid": "7500f389-92fe-4681-b800-6229ccc6ff57", "comment": "Malware payload (Mirai)", "value": "9af03e60a4ecd47e1712094624e7059d43ecf03ea180672af92f32af69d873d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721853, "uuid": "3b26c6a8-9d89-4a38-bfc1-96bc6a01d14c", "comment": "Malware payload (Mirai)", "value": "760a1a696b6cf2d5f61081863637c86abdaae65a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721853, "uuid": "2e3e7718-ce52-4ec8-8691-991163283af4", "comment": "Malware payload (Mirai)", "value": "0a1612a445540255105a9e058d42679615f4ddbc7c5430af6757a69f2934a183734747d3841f2ac37595ec0de17f5ec8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721853, "uuid": "832db4f7-a9ff-4767-b89a-766567c63708", "value": "T1FE331B8D6C121E5CE6E268FD50629F0D9E545321A0E3070FA3AFFDC33D33268AE55699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721853, "uuid": "2aa5be2f-18a2-4076-a97e-372c1d7b28e5", "value": "768:mGGluwT36OrBoNeg9HGx3oEHG4aqqeX5prMgPQrvD7TW5vjUUg2U7tCyk+f1pr9M:mGGNYHC3JHG4a7drQq7tC/g1p2e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637721853, "uuid": "08e3b2b7-370c-4a0f-b053-258565099163", "value": 54796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637721853, "uuid": "77fc2ed2-c15d-4be5-bd07-4bd331e6ace8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721853, "uuid": "e2b2f1ae-7a06-433e-99ff-dd01c0c91396", "value": "ab97277fd974a2e139047d3f28cf108b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c1c399-4cd0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637721867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721867, "uuid": "56872fae-c333-4734-9e76-b97839ef4448", "comment": "Malware payload (Mirai)", "value": "14295b4160fc035bd32ee64454400982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721867, "uuid": "7b18f637-0e91-47a1-bba8-4aacceafcb1f", "comment": "Malware payload (Mirai)", "value": "9bd39546782408a2b9f4101cee4bb70b729908d2ffa74bef53533aaf0b9b1c8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721867, "uuid": "9b8b9482-6fa3-40d8-a9da-4ba944847653", "comment": "Malware payload (Mirai)", "value": "cf75af333bf39311c185d70694f46eff39b36403", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721867, "uuid": "c6e83795-f8cf-49ed-9af3-986356ff3547", "comment": "Malware payload (Mirai)", "value": "6a531fbf1172262e892f2a9372dc5929d5142bd86137804d4cd8eb7eaec9e8a87e230b01625bbdd6c6c2faf530900a9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721867, "uuid": "5cb93d79-02f2-4f3b-a1de-852527406127", "value": "T1A353FA817C81AA29C7D0477BEA9F108E3314A7D8E0DB7357CC544B507ADA85F0DABB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721867, "uuid": "63edddf2-eb71-4b0a-abfa-4b434bd77ce8", "value": "1536:GX8UZEywoaR9cWwCBUyToBmATRwCCHX0B/KhYceZW+cUMM:GX8qEWA0lKKcwUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637721867, "uuid": "92ba96cd-d2e3-4f01-81b6-8faa709510bb", "value": 64048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637721867, "uuid": "de02b4e2-3614-4e93-9254-1c07f4bf8ac4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721867, "uuid": "25a6439c-80b3-4652-858d-fbc1e5b2b6b1", "value": "14295b4160fc035bd32ee64454400982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603a8362-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637762641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762641, "uuid": "5f2acbe7-bc09-428f-9dbb-42a1b4bf57b4", "comment": "Malware payload", "value": "9171ae774035bb28b129e73f395e94ae", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762641, "uuid": "097b6db1-32fe-4b80-8281-f199adb7177f", "comment": "Malware payload", "value": "9c69d64a49263d4bad802075d88200a3b56ed1e3d698681cfb49cd8f573f825d", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762641, "uuid": "5da49dcc-d7aa-45a3-8f34-4ab8d73c064d", "comment": "Malware payload", "value": "e49eea329e1a7661e8daa2cbcb19a9876d24eb10", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762641, "uuid": "0e5c3070-3d42-41ea-b528-c981c515baab", "comment": "Malware payload", "value": "2c14109d892309451ab6e6f5856817d9ec5e59ff43a1aee700c9bba1bf9e7a2b97a4fe591d1b55c5281893237a243566", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762641, "uuid": "67d9fc23-cc6d-472a-8888-55f66195ded0", "value": "T1C002AF159256A5C9CA5043B9A24E243C3CF8A01E2F64F7C9C86FA9522C81C87B11178F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762641, "uuid": "02d6b569-355c-49f6-b1cb-ff3e5c9fb613", "value": "192:8CPQUT3wHUGBeoIGSyU7IQoEvfRKbRsu48iHSPYu:8CPQaqftQoew1su4iPYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762641, "uuid": "79ac2cfa-cd20-4de3-a8ca-f44b666996bf", "value": 8550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762641, "uuid": "8764ce6d-de39-42a1-b7f5-9331c4e3326c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762641, "uuid": "3efda752-07b3-4e26-a863-62003b4d64cc", "value": "TT-PRIME USD242,357,59.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa39466-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744459, "uuid": "298e9742-d934-4d2b-94dc-ba161d7845d1", "comment": "Malware payload", "value": "81a3d2d9d3f5e5c585327c21ab55260f", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744459, "uuid": "c3752f69-ed6e-4ec4-b7d6-bf31cb04eb2e", "comment": "Malware payload", "value": "9cc93e5424553c5534cb8416357c38923ee80da05a5d7b0d332932f5771ec3c0", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744459, "uuid": "bdd96b61-42ea-49b0-af9a-e56df3870093", "comment": "Malware payload", "value": "72c51b2eea410f51fc0689026d6ba79ebd36f3f2", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744459, "uuid": "20112484-1520-42d3-928c-d57932167b0c", "comment": "Malware payload", "value": "f4aea4b7b06108a13f04bf286c0617eb4b48145773daee04904eed1b80a991b77a168290cb37c676162cf45c5f8ef547", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744459, "uuid": "faceac02-7a71-4c0d-908a-67ac892424f7", "value": "T1E9E533398E3B79DA507D1616581213F39661FCDD0828F41AA3FE96CC348E5F4A8C6BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744459, "uuid": "9bfddc11-9901-4003-9e4a-843e69b61251", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7aL4gxQzg+H+:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744459, "uuid": "1afd1280-f89c-4e79-9ac3-266ae4609658", "value": 3100672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744459, "uuid": "be11fbbf-a9d1-4a4c-b29a-63774e9a4ea7", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744459, "uuid": "c76a1c9d-1dfe-4395-ad7a-ec30de50fd2c", "value": "9cc93e5424553c5534cb8416357c38923ee80da05a5d7b0d332932f5771ec3c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d365fa6-4d56-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637779440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779440, "uuid": "20b30661-dfdb-4d2d-b483-ce6a3c7a0fc1", "comment": "Malware payload", "value": "3fe511771d4c3ef34f8c1e3eb043cdd4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779440, "uuid": "73ab3c24-693f-4c8f-a048-2713682f2082", "comment": "Malware payload", "value": "9d187e916dbfb1a91f6045507f1e1869d609673d4ebedb10f2ef67923d705048", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779440, "uuid": "3c91a2d9-28d0-4b42-bc40-7c07cd335f8a", "comment": "Malware payload", "value": "67e3aec0b490c53235e812a1f87ec3f42090f804", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779440, "uuid": "14f69f3d-e8f0-441c-86ad-2f94e9950d73", "comment": "Malware payload", "value": "23b7decf0da958d4bd843eb9ce16b295d68497d2ded8a400d60c71d08be53b648ff29a518c21a1abdfde72dba3903037", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779440, "uuid": "c1f17145-1e0e-4406-85f2-0f41f9966f39", "value": "T1F295168303452BA8F38D0FC88AA6B4171CF2D4567C64155CE7BF69EFAC2BEC81474669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779440, "uuid": "278221fb-cc7a-4b13-b04f-e48283dce1d8", "value": "1536:08GZjbVVKi/nPRDcJXdauB/shOdeOl+EOf5Mr85ytZYJWDDjGd0IR/a6UusQSoZW:gVg8WyiztavAuOZJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779440, "uuid": "823f89f0-079c-43d6-b800-0079f01a5dd2", "value": 1954767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779440, "uuid": "f6a8fdd0-1aa1-43ad-9349-96ed3a3e4fb5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779440, "uuid": "8ba99ad5-a680-4ab2-a41d-c62dde90aab1", "value": "F.A.Q[2021.11.23_19-17].vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22945668-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637774563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774563, "uuid": "f0aeb372-34de-4b57-8a7f-eccbe36e117d", "comment": "Malware payload", "value": "63ca28f5cd11889e8a0b3a061dbb37a7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774563, "uuid": "95721610-b9a9-484d-bd4c-c37dba8978f2", "comment": "Malware payload", "value": "9d94e46e9f6d2bdd13cb7896b47f3c16bc8a3fd9081dc6a3e1c196def8577cc9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774563, "uuid": "7bba26e0-7fa9-46a4-94fb-4df95f510c7a", "comment": "Malware payload", "value": "fc4ed820ba21e7aa22b324815fdb88e7953dc17a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774563, "uuid": "2ba16ac5-bffd-4e93-944d-e8d1d6d343a5", "comment": "Malware payload", "value": "76e0c44268281853e8ea60c562e67b8b2b6a6e78bf2fd1cb19e2c7d2005ec49e3152e4aab74bfe23531a5835eb6d1d75", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774563, "uuid": "65395132-37a9-47a7-8663-bf0ccbee6af0", "value": "T18A954912F2BD85F7D16336FB99DB6365B825BD30292458062BE83D4CDF35E903922293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774563, "uuid": "8f0e8fee-8c04-4a23-ae5a-acc575929124", "value": "24576:Hk4FGU3sxMW5AkN43V726zrsvlwalQSe8TU+aVe5GYSASA:Hki0y7BzrshlTPaoGYS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774563, "uuid": "b1ce58e0-000f-4af8-b5b9-1dfe67a0d002", "value": 2016768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774563, "uuid": "b466aed2-d11b-4e1f-a4fc-d9fbbd4d62b4", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774563, "uuid": "06764ec1-9140-45be-94cb-a662edbc82f1", "value": "contrato-copsw-actualizado.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35b64fe-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637736581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736581, "uuid": "a3c0de27-8a1a-4bbe-a307-1b4e7f59fc59", "comment": "Malware payload (Mirai)", "value": "5d2f2c4b6c9642a872c2ff590d6f8cc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736581, "uuid": "8eb34cc1-5a42-4477-99ff-adc38fc86c8d", "comment": "Malware payload (Mirai)", "value": "9da929cd6c9245af074045144e484461c3d7706b398bcb83fd44aeed176c4061", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736581, "uuid": "2fe07ab5-cd62-4a60-86c8-9e8c8e057730", "comment": "Malware payload (Mirai)", "value": "6d65db7dd6977e0d883f951aa80f2a899f9d13cc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736581, "uuid": "19ecc40b-4ff9-4fad-9340-6881784137a3", "comment": "Malware payload (Mirai)", "value": "50cacf3713e50bc3d53e35db3cd09ce1d0234f4a90e6d5061a0c899a208110c2fe2a5cce370796d8e8a214674eca53a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736581, "uuid": "202f911d-6348-4e73-bbc5-6dd74d274265", "value": "T161B3941E2E218F6EFB6C873547B74F21F24863D626E1C644D19CE6015E6434EB81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736581, "uuid": "def1cbf8-84d6-4344-9ea0-df23ee8eeb88", "value": "3072:KqjVnSYKm2/bpzzVKsEy5n9/Hky9DwbZnWf:KqjVnSvm2JzVLEmwRWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736581, "uuid": "a0999236-5192-4eb9-a737-1b6b79acb852", "value": 109392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736581, "uuid": "35930030-e64e-4215-88d7-415eca702503", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736581, "uuid": "91ab8a71-907b-42e1-822b-9c6ca2e3ee32", "value": "mips-20211124-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131ec7cf-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637782268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782268, "uuid": "22be317b-12b2-48c8-8e66-1b3cec6e68eb", "comment": "Malware payload (Formbook)", "value": "0e8ecafcc4dac9129241e73027dc38d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782268, "uuid": "e6bee043-51c8-4998-9ff0-a1ca10993449", "comment": "Malware payload (Formbook)", "value": "9df726f24b0a1282ca604a08a4648f527dae3e61712ea3954305362dc3ef4e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782268, "uuid": "7f3cc07e-1271-4925-a40e-aa6291dddddd", "comment": "Malware payload (Formbook)", "value": "f18003b9ab2278a390f5728a2c83e7047737aa25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782268, "uuid": "0adb4037-f836-4519-a1e2-6d4cefe97db0", "comment": "Malware payload (Formbook)", "value": "81e2bfa98711197e84e90572e2b79127258360f76ff1b766740f1ce89a9aa2abd580884333cac565a3511ed0cb77e770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782268, "uuid": "380f962e-9b36-4a45-abd0-8054ade8bbdd", "value": "T15B54230BABB16567D1978FF12272F2BCE3FA80C54B8B194F4B202DAE7F122475758142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782268, "uuid": "b96308c3-4ab5-44d9-bcb8-005124beda04", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782268, "uuid": "c9b65311-f7b5-4263-b89b-a5a56692ff89", "value": "6144:rGiU9hd2G9Sa0bnfW7v+osgM8kzF+xNFxtsJusTQUqxMIF9GN/M:khhWbfWb+osz8YIxFiusT2xMC9i/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782268, "uuid": "6a6f64da-fa45-4411-8ebd-65683826dd19", "value": 303917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782268, "uuid": "41c5371a-011f-4a79-abf0-14af28d3e93d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782268, "uuid": "410c3a7b-8e96-44ed-ba9d-e4b880fa604f", "value": "0e8ecafcc4dac9129241e73027dc38d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1bb977-4cf7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637738772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738772, "uuid": "8cd7dc30-7339-4bd3-a008-e26258ec3df5", "comment": "Malware payload", "value": "f317b6bafb5c6f4c3c9ffb967fd941b5", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738772, "uuid": "e0111993-70fe-4b02-a90d-8403758f7d0c", "comment": "Malware payload", "value": "9e4763ddb6ac4377217c382cf6e61221efca0b0254074a3746ee03d3d421dabd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738772, "uuid": "a0fe7d2c-356d-4fa9-8e8f-23b9ea3159df", "comment": "Malware payload", "value": "509c2115bfbb20e65a08286935cfac1305894ede", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738772, "uuid": "0ca92e1e-ef00-4a75-bd37-b7eec35de95a", "comment": "Malware payload", "value": "debdebad0d43566a14372bd439077bcb6ab42e5840d167af98c2b9e8658321d937c9f80556b390ca37d58d431b9dbee9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738772, "uuid": "bc67af6a-0ce2-4902-af14-18c2a955ff80", "value": "T17075DF1176D6C537C06701702E2ADBBA9139BD700B32C5EBA3D81E2F6E716C16672F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738772, "uuid": "a25ac7b1-609c-4798-af54-b8ce6a2e5ebe", "value": "d6612a3ed6fd33f95566d0cb5aae2cc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738772, "uuid": "72c27134-ee44-445e-a60b-b4603a45c39a", "value": "49152:6gUgbYXwB3FHjD5JPz1MbEUl8VlvfxA7vW/LL4Niv:6sYk5JPpYEkMAzWz8iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637738772, "uuid": "20607b82-c8b4-4abb-94ff-165e70dd3054", "value": 1601536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637738772, "uuid": "db06c774-966d-4dfd-973f-0bc01a4bd07f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738772, "uuid": "16ad67ac-c839-4eef-9979-4a70dca8b2f8", "value": "InstallerFileTakeOver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a7d47b-4d62-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637784417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784417, "uuid": "b5d51ffa-d3ac-4024-b9da-ebb0055627bb", "comment": "Malware payload", "value": "d719525c01c2c5be42a15553eb2e5239", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784417, "uuid": "072ec967-1105-4396-a94b-17fa921bdaaf", "comment": "Malware payload", "value": "9e4ead84cf86a60f1b58f43f8160cff61273b15e0c1943d40b7ee58911b2058d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784417, "uuid": "fa30a401-90b8-4fc0-b062-87bb94867ce4", "comment": "Malware payload", "value": "5faf00db9f3433373390fc30c48d2b319847de9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637784417, "uuid": "331ed2e5-6c87-47af-8660-7840d29abdfb", "comment": "Malware payload", "value": "7e1a93a104fd7104d0214e04538c4b1fef36e52932fdc16e831abd0e628863d0898eeee1077d6330fe701e910600b237", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784417, "uuid": "54e1cbd9-2eba-4627-98e4-455918bd720e", "value": "T1C003F19F27BAA437F021857CE6B70B6BA75D34884165DB5F1C8980E52CB2833FC64B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784417, "uuid": "b71af690-44dc-45bd-9838-ac989d1caaac", "value": "306d05b6ec300efbbeab0bf07f3d34e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784417, "uuid": "25bd5f40-c290-476e-b2f5-ad8710131e00", "value": "768:feV8PtvqEjPCMm2UdHZwAqou9TMR75l9rpNz7BngSesIVQ+m:MEBrUYAqo1hXJBesGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637784417, "uuid": "7b76b2ee-5648-45e9-81d8-aea583787df0", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637784417, "uuid": "ec2dfb99-7a1d-4512-ae86-3425bba22644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637784417, "uuid": "fa005bc4-483b-4f6f-8242-bbc6aedf3c84", "value": "d719525c01c2c5be42a15553eb2e5239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b00101-4d4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637775666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775666, "uuid": "a4cbb5e0-ab3f-4212-bf7c-b20597574f1b", "comment": "Malware payload (Formbook)", "value": "b5d0eb95a5cc13b81481a3d1caf7b682", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PO201808143_330542IMG_20200710_0008", "colour": "#72247C", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775666, "uuid": "17aaabcb-dae4-463c-8e3c-18bd0d9136c3", "comment": "Malware payload (Formbook)", "value": "9ee0e41ed56d818e000459fc1d044f811b091d8b7d2963129968d66c56828dc3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PO201808143_330542IMG_20200710_0008", "colour": "#72247C", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775666, "uuid": "83e61282-1e60-4d55-919d-623da0e2a943", "comment": "Malware payload (Formbook)", "value": "c97da74e5b73bf00a8d50cf2b93c6eb40566a791", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PO201808143_330542IMG_20200710_0008", "colour": "#72247C", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775666, "uuid": "b5f33d85-74cd-4513-acb6-4094cd9da441", "comment": "Malware payload (Formbook)", "value": "1b06126a942799887c7dd369b5ab40fc517379e408ec6fb830c34124f78be0055084f0b8e4eb074475d7a87ec203512f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PO201808143_330542IMG_20200710_0008", "colour": "#72247C", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775666, "uuid": "4c8008be-28ef-4eb6-9c23-d6977e5cc663", "value": "T1EF72D5ACC06711E8CF8987F4A72BAF85114C3A2DFB94A172727C637117D2E3A801687D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775666, "uuid": "4d9f06f6-dcd1-4074-be32-5490012a8f8d", "value": "384:LIGEvUaVz1Pi+LKArQphjqLsTyTF4fSL/:LHEvUsjXmMqsqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775666, "uuid": "9ec2681b-753a-4e22-aa52-c66eaa28b99e", "value": 15981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775666, "uuid": "c3c8a058-5d53-4123-be43-021edefc3469", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775666, "uuid": "c0566f17-33aa-4297-810a-08885cb23cc6", "value": "PO201808143_330542IMG_20200710_0008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c8bb31-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637774535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774535, "uuid": "54c67ec8-7c26-4aa0-99e2-2867ff29e12f", "comment": "Malware payload (AgentTesla)", "value": "c23f5789a3dd1db347c7d28a6c0dd2fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774535, "uuid": "4045aed5-1e7a-4394-b784-a451156dab48", "comment": "Malware payload (AgentTesla)", "value": "9f6119bb00766a94dd84a40eb10a44edbd69fbd8087d5485034e8b8e1b9807ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774535, "uuid": "fa674908-9e70-4602-b888-7c688f7feef7", "comment": "Malware payload (AgentTesla)", "value": "0d0d64f22c8d9433bad96b5030a61d05047d5c48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774535, "uuid": "61dbb02c-80ef-48c1-b96e-e4d10143c793", "comment": "Malware payload (AgentTesla)", "value": "97f95f3c383173e82736ebb440bf7931493aa34b695f2515724930622c4bcf00029f4ae7cee7eeef67c9ebe50a195975", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774535, "uuid": "e640b324-5957-4415-ae94-d8aa8928783e", "value": "T1EBC4F1FA526C5E3BE87ACEBE35C140D3F265758B3440DA54A9CD83171E816C23189EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774535, "uuid": "ceae381a-0026-48a4-b05c-339e43af92d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774535, "uuid": "a6c7839f-31b3-4dbc-9fef-fc4cab292d22", "value": "12288:875BO/v0Fe4VIbHTL+o6nO9IzDDbQbUbD:875BY03VIbzaY9gzQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774535, "uuid": "522f91ec-a857-46b6-920b-b1b8df94292c", "value": 564664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774535, "uuid": "b0d8b35e-ad1e-4f3f-a2da-447ca8c31832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774535, "uuid": "9d78ab92-952b-402b-bc90-1f981e73fcda", "value": "ORDER 759325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3213d023-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637782320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782320, "uuid": "81ac8ce1-d260-43a6-9508-c785b74ec541", "comment": "Malware payload", "value": "1bec9d7011433adbd9af2ad62542c443", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782320, "uuid": "3573f7bd-99b0-4006-ab65-b3ad24bd796d", "comment": "Malware payload", "value": "9fc37df8a46d95ae0687bf890ee61bf50fb3e0bf2d4da77c139c93a813d91a6b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782320, "uuid": "31d27e9e-c234-458e-b2b9-639c034a0c14", "comment": "Malware payload", "value": "d7cf16bc28126069601f55e7c820d8b31fbff6d0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782320, "uuid": "304836e2-1d6b-4b07-aab9-159db3364ca4", "comment": "Malware payload", "value": "b60b2ba8fc870b43e7ca365c0d8749bd99068ddfec26b357e6857ad16bd84cd422e05f0cddc51c0794cb7bf7505c127f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782320, "uuid": "dfe8f96f-6b73-46f8-bf29-35148b113b50", "value": "T14BD5DF11B687C536D4BD05712E2DEB5E40397E720BB594EB7BE81AAF19B18C20231F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782320, "uuid": "470b0938-3b29-4684-8a50-80267568d2bb", "value": "49152:YcUil7CPthQ0aSaLN5hPx2XofEaMH5+euXxVF4JBrR59GUrSLzeaVtFUVYGlrXVu:Qil72qLNHJxMHRFrEcYGl7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782320, "uuid": "e07869ab-c9d2-440e-896d-aff3eec3def2", "value": 2927616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782320, "uuid": "2eddc7dc-5ea9-4a8e-b262-746ec8a3ed9e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782320, "uuid": "88024a7c-4f0c-4cff-a5a3-25aecbdba5ca", "value": "Proc.Eeletronicoeqhrh5j9 nwtect.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5f1426-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637779068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779068, "uuid": "ee2225ad-de86-4194-82c7-f9fb2593acab", "comment": "Malware payload (AgentTesla)", "value": "057a0d5787ffc98345ffb64d7f61a837", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779068, "uuid": "0a5bc42b-96a8-4a25-bd50-726ee99fb5a8", "comment": "Malware payload (AgentTesla)", "value": "9fdfb98f00c4b026f84fd077cce02849a7acb320916d68f9ee5a439689a2caa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779068, "uuid": "53ecd851-53f1-4bec-bdb4-268c29c66e14", "comment": "Malware payload (AgentTesla)", "value": "58a73db832f4ae21224f9ce2adb5c807d765e9c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779068, "uuid": "becd1b85-d359-4634-9982-3f1663d3b46d", "comment": "Malware payload (AgentTesla)", "value": "96fde4af2adeeb72e3be808f7db494fdcc3a154b6ef3ba4a72ff72e23563e77dd8f9d4310f7fb80c14d5478fe4ca262b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779068, "uuid": "fcad7a78-1bcb-4036-afc8-98d27f0139c8", "value": "T1BAD402663398BB83CC364BF1187252C223B269162514D76DBCC931CE1E36F595722B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779068, "uuid": "7a7a62a2-0183-4400-b14e-c5bd08466ef7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779068, "uuid": "241f8c49-328a-48fb-8a8d-eb7e0016d53d", "value": "12288:ftD00AO0FySwd9SXXivIRkMm850iq5nc:fC0z0FyV/kXiwRkMm8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779068, "uuid": "c2d89aad-aaff-4e34-a501-9d4e99de86ee", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779068, "uuid": "12f0a5b1-1557-4b16-8498-67e788d9afd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779068, "uuid": "118ae8b6-a9b3-4410-9f68-fe1ece931cb1", "value": "057a0d5787ffc98345ffb64d7f61a837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7437c496-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637763534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763534, "uuid": "6d4adbe9-730b-4dc5-85d5-dabb73e7422d", "comment": "Malware payload (SnakeKeylogger)", "value": "77d302aa1eef81b222dfdbd3c57e63d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763534, "uuid": "1fb96e00-4de3-4c43-8b47-a9cb7df685b5", "comment": "Malware payload (SnakeKeylogger)", "value": "a0086701cf3e35d0a6568c88ae2288bf93a062391923f835704f03f0c845baad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763534, "uuid": "a8cdebe6-ca35-4ff9-8c88-08de88a87bdb", "comment": "Malware payload (SnakeKeylogger)", "value": "8f1cae4cbaed245879c1a69d364428b934478e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763534, "uuid": "34a6a5df-5e9e-4963-a197-fae8eee7f5ff", "comment": "Malware payload (SnakeKeylogger)", "value": "345b4ea771924c04ad948537858a7e13bdda8f77f4a2d95fb91a91d085bf673855a6196491ad96ce1671d18385295d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763534, "uuid": "50dfec04-3436-482f-b293-699aa5d5987f", "value": "T188C4E03BC2285637C7FBC77525D24643BBE01B973843E993A9CE83511343A6A339526E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763534, "uuid": "ed790311-55e2-4e8c-9d5a-d1edfb45e765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763534, "uuid": "7efc5a59-b858-46b1-879b-77565e707aba", "value": "6144:d36Uxa/gsojaue4VIESQXeGYTizUC6iHIC3RIsra9IRBNJSnYtNCUbGc13qJHbCC:d3hxa/v0Fe4VIbHTL+o6nO9IzDDbQbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763534, "uuid": "2a704f1e-083e-4f03-af4e-2478b7483243", "value": 566200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763534, "uuid": "1d0f9a1e-06fa-4068-a78e-1d6aaf668d47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763534, "uuid": "4a79f1cf-6ae7-4fcd-8d41-3925600ce26f", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6248fae8-4cfa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637739881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739881, "uuid": "570a1baf-1d66-4ecf-9b9c-14e38e268faa", "comment": "Malware payload", "value": "b931840f489fe1531c3103418fa32d7b", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739881, "uuid": "448e698a-84b2-44c6-8f6f-2048dbdfcb36", "comment": "Malware payload", "value": "a018545b334dc2a0e0c437789a339c608852fa1cedcc88be9713806b0855faea", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739881, "uuid": "aebcd973-ed9b-4b9c-b591-235dd9d0adab", "comment": "Malware payload", "value": "af4931a10f14ca8427f53707125d761217be3a6c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739881, "uuid": "d78a7e97-aa0a-46bb-9d5f-ce81b2f142c3", "comment": "Malware payload", "value": "2c9e1bbc64bf5f11c5275c82fd19bbe77915f4680e817a0b1a9ec70fce549db28144faf687e761ec514a7234056caaf7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739881, "uuid": "459a2191-a4a3-4f12-9f4e-bb3015ba295a", "value": "T1BB75DF1176D6C537C06701702E2ADBBAA139BD700B32C5EBA3D81E2F6E716C15672F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739881, "uuid": "a4df159d-8794-4880-bebb-1d68df5db15a", "value": "48497234bbb82de143acac3ae3894c67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739881, "uuid": "8efecdd7-47df-49f6-a365-3396056ab71b", "value": "49152:VNYUgbYXwB3FHjD5JPz1MbEUl8VlvfxA7vW/LL4Ni:DEYk5JPpYEkMAzWz8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637739881, "uuid": "2e110863-70b7-4493-9a70-fd575e18a982", "value": 1601536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637739881, "uuid": "f6ff8e5b-74fb-4284-af6d-3ad058b681fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739881, "uuid": "57062c20-1d89-4beb-9dbc-7de3066caedd", "value": "a018545b334dc2a0e0c437789a339c608852fa1cedcc88be9713806b0855faea.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aebd3a-4d36-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637765809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765809, "uuid": "63f6549d-0a52-4d7d-926a-b76f178baa24", "comment": "Malware payload (RedLineStealer)", "value": "6dab13a0be0bc8aa208e728d7a60dcde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765809, "uuid": "25be09e9-619a-4122-9921-a9aa2aed05d1", "comment": "Malware payload (RedLineStealer)", "value": "a0338becbfe808bc7655d8b6c825e2e99b37945e5d8fc43a83aec479d64f422d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765809, "uuid": "a6715072-58d1-465c-ac77-e9d9c2b6bb78", "comment": "Malware payload (RedLineStealer)", "value": "924ccb917b40f51d378901bc5a29eb6214b52b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765809, "uuid": "f5eb051a-b263-46ea-8036-bd5b74d11899", "comment": "Malware payload (RedLineStealer)", "value": "d10c80d2a127ebc3ed7bcc8fb15766c591d78502b9512b431c6e16523585adc840d042cda72692cddc94317893f57b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765809, "uuid": "b4637c18-9613-41fd-a346-b89e3ecffe93", "value": "T1EAA33A5437CC8A05E6FF0F707CB4111883F0E5976412EB5F4DC954EA2E66B81AA62AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765809, "uuid": "936d3ca6-e32a-4d7d-8aa7-2cd2f375eff1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765809, "uuid": "3a8cc7f0-0253-4973-a439-3e85fc28b947", "value": "3072:jDqzD4w3sRevBP2wk1tTK9R1LLLnL+f3N2I9vXpG:g4MsRevBP6JjlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637765809, "uuid": "a784719f-ccc9-4282-9a28-dc2ccbd65a2d", "value": 106728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637765809, "uuid": "a480f992-af2f-4280-aca2-11ea07870915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765809, "uuid": "8cc06d4e-412f-4998-8012-ce2365ec1cb8", "value": "FortMod 7.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b711d98-4d6b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637788349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788349, "uuid": "70b5dad0-52b9-4e77-9828-7f3da8ad37e5", "comment": "Malware payload (Mirai)", "value": "f177556b1af0c5d3e7de6b771c0b93fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788349, "uuid": "8ab517ce-f2c8-40bd-a471-7409b7207b9b", "comment": "Malware payload (Mirai)", "value": "a0774f6da71dfd8abdbd4b1e626a852b853dc3c80d6420d8b696bdf40da73ea8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788349, "uuid": "2f225636-5238-4c9a-8e7d-21940f4cf71e", "comment": "Malware payload (Mirai)", "value": "49ff271223d7dbeca2ff669b614223198324ed20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788349, "uuid": "abd30e8f-6aab-40cb-a97d-80d3d81f2351", "comment": "Malware payload (Mirai)", "value": "edd601d05fa5b3f7dec5bbb5bd9b313dad1fae5a5ba9b709b24fabdde6e6d7da0c2b654a2f16415d59b10f342341149b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788349, "uuid": "d2b16bc8-01bc-44eb-9167-ce40ba3a732a", "value": "T15D635DD9B4019DBCF95FEABEC0224A0EF931670065930F2BA6A7FD937C720959D42C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788349, "uuid": "d6d0f265-d98c-429b-937b-ad637f2e3a11", "value": "1536:ilwyVg4KbfQ1NMQ8tmUK5RCsGEO179vtWfLBt6Y90Y8/:iFVg4IUmsGj79YD6Y6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637788349, "uuid": "ba368ee9-ff35-4a26-8586-964414882779", "value": 67948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637788349, "uuid": "2a2499d9-0195-4473-aea9-35d849a837ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788349, "uuid": "f6ab8488-e0b3-47d4-9d71-d16d0276d506", "value": "f177556b1af0c5d3e7de6b771c0b93fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b923a6a-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637774766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774766, "uuid": "71cb0f18-28f6-40dc-a6ea-e5a5a105ee6e", "comment": "Malware payload (Dridex)", "value": "0e74eabfa1fb0f7c526ab0ea42c8738c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774766, "uuid": "2cd3d072-77d6-4cdf-8b5b-db6fa745696a", "comment": "Malware payload (Dridex)", "value": "a11603868f1a1bc1728c43b8ca3172021d3dbc0bbe554f436b41e71bbffbaf39", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774766, "uuid": "d12d88d9-26cf-4911-8f96-15332137228d", "comment": "Malware payload (Dridex)", "value": "34b8f4403fe5fb436d08b2e5fcb3eb4710a1c652", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774766, "uuid": "91665740-035d-462e-91e1-8b17d8f603bb", "comment": "Malware payload (Dridex)", "value": "4705485ec73b3c0728130d2491c54f15ce937b84551f75a54bbce0901b158a5eb7d603055c6e56f34f48cd556811af7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774766, "uuid": "5b8165ee-c866-4f8e-8121-b8fca8b1d00b", "value": "T1FEF4C15536FA19A8F3D8A27AF64019A12A5F830D10BD8AC05EB07C710DB6FCE55DA0FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774766, "uuid": "cf9caff9-9506-463e-892c-fa438204e14e", "value": "90b59c6ea388daa7b6008a55178494d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774766, "uuid": "2e436eed-e3a4-417e-968b-6139cb2ec764", "value": "12288:43rRXZOdQwBEyG1vrCUKgmB5iz54cb5c4v5W8z5+sz5scz506n5+ez5oG15ouv5L:431XUc4g2iz9bhvJzRznzbnzzX1Pvxrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774766, "uuid": "8140f8d3-c9ac-4472-9822-5bde23d30445", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774766, "uuid": "fbf49459-d34b-48b2-b892-54b0f825e1b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774766, "uuid": "01d46a01-ccc9-44ec-8f04-ef1735fcacbd", "value": "0e74eabfa1fb0f7c526ab0ea42c8738c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b374ee-4d32-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637763959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763959, "uuid": "a0f623d8-45e5-477a-9f2f-d93f29372595", "comment": "Malware payload", "value": "9f56248e0dbc9e486d55ab62dea8f1f5", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763959, "uuid": "6920fed2-3ee0-4668-a652-a1cc48759d6d", "comment": "Malware payload", "value": "a2239205b2048e1bd4058607c7ffcfc0b91f4108d321d2cf8d4b55c104b1fbde", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763959, "uuid": "c2fbe42d-192a-4962-939a-4e841d831f7e", "comment": "Malware payload", "value": "842e5d8e4b68d515da426ccd83717ecf161667b8", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763959, "uuid": "92f90233-1e40-4e50-ad74-3ae1655b7115", "comment": "Malware payload", "value": "ef653cfa3617088f8b4bd941222276ff57d847b6301ec8fb4e23cc07cf70bb8504d29ae2f746d5a36a3193379d797cb1", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763959, "uuid": "9de8e20e-a3ed-4ba0-b6fb-7796cdc326c4", "value": "T1353412A87E7DCCBFD1966938049E95E2D07BEF8C1184180A77737A664D3060BEBE0946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763959, "uuid": "bf02586b-877e-4d81-a4d8-27383e3fa9da", "value": "3072:zecZtcJGgX2G2rMYEfC+B4NUbXZ6r5V+MvlKpUl6uIOu2AmMYFrq6Q+lQnfOApxv:pZJGwMQY+5bJljPGnWApgLX/O6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763959, "uuid": "b15af9ba-2d1e-4693-b658-25d0edcbb8fb", "value": 234248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763959, "uuid": "64fd7a13-6776-4ff1-8c1e-081e4941c424", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763959, "uuid": "16e68427-dd4a-4127-9a48-9ab90070ede8", "value": "BANK-SWIFT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943259b3-4d3d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637768741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768741, "uuid": "8056ee26-c8d6-4a21-b6ec-c1054f7a1f81", "comment": "Malware payload (Dridex)", "value": "e8475224481d49893878534d82b3cfce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768741, "uuid": "49e5e601-0e9b-4a7e-ad28-35c29984b03a", "comment": "Malware payload (Dridex)", "value": "a280bd9dda5d7761bd7a7a64f72d80816e5258c2acc3c55fd2ad37f373483ff9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768741, "uuid": "4e60a6b5-e22b-41dd-9887-bdbe4665bbf5", "comment": "Malware payload (Dridex)", "value": "fbb7b87b742f82d59f7eb4591fac41301f097b31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768741, "uuid": "f3bb600e-1950-47d5-8bb8-ab4a75b1d98c", "comment": "Malware payload (Dridex)", "value": "b37e7a0cae7d17dacadaa6f47251cd10b8ec82686e811de234b687cf3231373159ccaab58fff594010121d6f726566d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768741, "uuid": "cd30d5da-95ee-4454-b213-5fe8c4e5cecc", "value": "T12463F120CB6AFC51C2D642BC9158AEF1A1072A6DD851F21E2CE4B91D5AB13DF87DD388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768741, "uuid": "566cc42b-b903-4efa-82ab-4f60acafeda5", "value": "1536:UWgPqrE3gpMokPF58Ik4kosQFVvSuMuF7SL2FjNHmaxOs5Qgdi:VhEwFkd58IXkOFVvMuFjTzQgdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768741, "uuid": "bda09146-6dc5-4092-a4d9-5dd2caa37a99", "value": 68064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768741, "uuid": "7a629812-ea28-4481-ac19-c0cdeebbbf7c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768741, "uuid": "b0afe298-e0bc-4a6d-af60-8919e4c32646", "value": "subscription-84799.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1f7a7f-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637774710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774710, "uuid": "cb0d601b-7c06-4a13-89a2-66621fc6e138", "comment": "Malware payload", "value": "0caf4d7a8168b4197f2bbddcdfc8834c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774710, "uuid": "f35b4b4f-4d10-4929-8d98-8ba177a50dd2", "comment": "Malware payload", "value": "a3c1c7175ca667cc2d8ddd4b51a2d1fc0809dbfff784d29f0d44c346f0ef4c2a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774710, "uuid": "f6b90cef-1419-4605-8150-6a6f5cdc244e", "comment": "Malware payload", "value": "b80ae18d48f8d083fa4982860b2a69aac78400f0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774710, "uuid": "0d5882b8-50f0-4e91-ac4a-e576c561cd7a", "comment": "Malware payload", "value": "e8a4e4a8c18a9d62db3e48fdf92246769706d2b0ca14f922b922e97ff73cc8ca00aa37d75b91cea1cb1473e2db006312", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774710, "uuid": "530ff537-e3f0-4923-ba94-8b16d532126d", "value": "T1C8E5230776C44B3BC4AE0A32969BC3368266BCB49551C41B639D5B1D3EF3664B3A33D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774710, "uuid": "195ad51f-7ab8-4345-a4bd-ed3843dcb8fc", "value": "49152:SnIuY5A6byFtk1F2dRj45Zize1bpQ0LrUSw9C8gTJq/19n+s9RFz+p:YY5A6b+tW8dRj4JlnvizR1Ys9RFz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774710, "uuid": "a3a1c8e1-8a9e-4561-9278-d144845dcf20", "value": 3090944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774710, "uuid": "0ea51670-c342-43e3-a314-8998bcc9e4a8", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774710, "uuid": "4f83b0b9-4835-4207-9c11-367977204da7", "value": "0caf4d7a8168b4197f2bbddcdfc8834c.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf1a4ac-4d38-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637766607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766607, "uuid": "e1925e4e-c70a-490b-b633-ca852df7a9da", "comment": "Malware payload (Dridex)", "value": "62dfae450a8385f7da9ca2c4dcb33122", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766607, "uuid": "3a594123-9216-4951-8f11-f39211bf4b71", "comment": "Malware payload (Dridex)", "value": "a3f2dda58a7e94063ea986eb302bf880f438c46ebec19776a696bdabb2fa83d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766607, "uuid": "52384cf5-a964-4755-8542-249063844383", "comment": "Malware payload (Dridex)", "value": "be2ba9dfc459cda13b3e39c1e24a632b0edfa912", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766607, "uuid": "34ac7a47-4b34-43e6-b805-09f9c82d7c3a", "comment": "Malware payload (Dridex)", "value": "b92c5347c6224da467b20bb034e0acceeed95179200981268138fe5ce8a1b1ef39ff9791854497a940ed9e4b39aae33c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766607, "uuid": "9059cdc6-fdb5-47c3-8edd-dd5a11f1f437", "value": "T1E9A3029EC0DAB404C1E768FFC18E29F1A82A076D4543F51F28ED62780FB508EAB5925D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766607, "uuid": "129b8ded-efe8-46cb-92d5-d1c4de91d6f8", "value": "3072:V9FzIsj8aipSW4vHREQ4iZKUb4ViXkGLaBEGXDNC0MhgdV:mOipmvxpZJkGLEEWDU0zdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637766607, "uuid": "8a519e46-2c9a-44d2-8b84-09c63a845ea8", "value": 100978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637766607, "uuid": "05aa4683-2e15-4368-b006-03f2a6795c86", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766607, "uuid": "486b0ec9-89e4-42d1-917b-d385d7edf884", "value": "tax payment52023.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6c6ac6-4d26-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637758850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758850, "uuid": "b90478ee-963c-43ec-9b6e-cca1dd9c84eb", "comment": "Malware payload (Mirai)", "value": "be72d02a0b080e698efc704469f5006a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758850, "uuid": "db12eb92-280f-497d-8d22-64b63e2320bd", "comment": "Malware payload (Mirai)", "value": "a428babd22faef3a3e12c1ca4b3832e3e6859c6e98d67b0740d8dccd5c1a7c71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758850, "uuid": "ae507281-1c43-45a9-abd1-8c2549bb1869", "comment": "Malware payload (Mirai)", "value": "e8e7965e7e2c632ef06dba67c4ba4a5831852f3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758850, "uuid": "727b4f4b-ba94-43d8-accf-efd3527a1a7b", "comment": "Malware payload (Mirai)", "value": "6a89ed868fb785f126c1794b892692c0cbf5e0e1e8c3611fe05326f8baf2134b7b5d891417dcbc79dac09461c5357b33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758850, "uuid": "c53ead07-9bbe-4b8a-84c0-c924d02dce47", "value": "T164C36C9AF4019F7CF4CBC5BA81270E0AB52093845BA30E27B266FDE77C720959F0AD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758850, "uuid": "1c9bb5c1-0385-4bc4-b042-9785b0db95e3", "value": "3072:p00qkg30/hpe72PEIQbo3mrvf5NFWflaL+f:kkg30/fY2PEIQyMNFWNaCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758850, "uuid": "c756f8f2-d224-4273-a2e5-8c228310532b", "value": 123168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758850, "uuid": "d94b011c-6873-492c-ab8e-ca733c88d4cb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758850, "uuid": "fa27eff4-efe0-4c6c-bd25-e976efc38e5d", "value": "be72d02a0b080e698efc704469f5006a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b43519d-4d26-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637758767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758767, "uuid": "23ae3bbd-4af0-4fc7-a587-35b3da9e1759", "comment": "Malware payload (AgentTesla)", "value": "b820d5dfefd3d4653bb99cc4fcf26371", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758767, "uuid": "3e3f2a79-2e4a-42f2-a62f-d97ef6199351", "comment": "Malware payload (AgentTesla)", "value": "a5306032f2e96e083148fda550e8ddc9200396f5824e7e4f636dba49f1416f82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758767, "uuid": "5e813f7e-8e65-4841-8f12-8b49b83bdab8", "comment": "Malware payload (AgentTesla)", "value": "4b8130d36ad34c24c4ad137875f7d0d8911bf5fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758767, "uuid": "74efa3fc-e9f9-4e65-9030-67fcc1686c57", "comment": "Malware payload (AgentTesla)", "value": "8bd4f571988d6a9705724043b48d22aca3cba85fc6664a87423db04d75cf59e337390f81d503ff56291ec30b6a35fabb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758767, "uuid": "48006440-debd-4196-989b-53b99a9fea41", "value": "T16A2419566714D560CB6F417FC016820831F1D707A72AD39F5AA6D8FA2F812CEF92B8E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758767, "uuid": "ed0a5cce-b79c-4abb-8543-8d65c432f8fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758767, "uuid": "de1072ef-948e-4f1e-8c9c-0965880e9790", "value": "6144:FU9B1qPUfRtVomwoP9JTsVBXraITfinUk:FU9B4aR0mwo1qV7in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758767, "uuid": "df23cfa1-459f-4e35-bbbd-caf13720fcfd", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758767, "uuid": "d1db5276-31af-4af0-b9a5-f0ddb383b9c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758767, "uuid": "9c1b9735-475f-47ab-9550-fbc7e1d7965c", "value": "DBE & Foral-81 - PO# 10428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d6f176-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1637774242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774242, "uuid": "d177e231-b942-41f0-9908-4c1d384fc127", "comment": "Malware payload (Gozi)", "value": "9f3b8462c508884f6966f3ad4a275799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774242, "uuid": "e8e80458-4fa6-4b35-bae1-b47584cf60fb", "comment": "Malware payload (Gozi)", "value": "a548ac73d6acb5a260cb2e1760946c37ce94d89f3cd2a5b126e266e007dfc543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774242, "uuid": "cd56503e-4915-4d11-8ee4-54a65948b72c", "comment": "Malware payload (Gozi)", "value": "6288e611de585a6dc56c6399ef03012698d60392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774242, "uuid": "325a1f28-72cb-4fbc-a29a-672baeea5f9a", "comment": "Malware payload (Gozi)", "value": "fa63e9b5baed72d224217452dc19cd6f439820030c2bf54f9d1c7547fadfccc662f5f3687c22227a1325bf78b7ca5753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774242, "uuid": "e55d33d0-2e3f-4ed9-a190-8963164a5b7e", "value": "T141549F00B7A0C435F1B756F889B9D3B9693FB9A16B2891CB52D116EA57356E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774242, "uuid": "442ee61a-40d8-4986-8948-d1194d47c3c6", "value": "62f526399c5bc6ba1d2354b3cc3131f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774242, "uuid": "b44d6aae-90d1-44c2-9281-6db472f684db", "value": "6144:0fcUtwkDhJYbsB/qMZSXuZet0yyen73jF20+Mpbz/CyU:0U2n1B/3ZSXuZet0yye7w0+MpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774242, "uuid": "697e6f4f-831e-43a1-a2d1-ec2fb5c1ee34", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774242, "uuid": "699d081c-50d4-45b0-bbcd-d0c8b4c9e987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774242, "uuid": "832c2764-8f90-4b99-b898-98a5c75e6133", "value": "9f3b8462c508884f6966f3ad4a275799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cb2df1-4d5c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637782144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782144, "uuid": "77fb26e3-0a83-4c93-bc69-58c9be83ec29", "comment": "Malware payload", "value": "51b6f7d56254b4ca7b6fcf9410a1af46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782144, "uuid": "2e6cf7af-3789-4179-90e0-5db6fe501333", "comment": "Malware payload", "value": "a5787cac066c8562aeb5ca371bb8a19d28b70d09b4256377d50f6190b172ae9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782144, "uuid": "a3f1e769-1e56-4f0f-a72a-9adb447893f5", "comment": "Malware payload", "value": "b0cfdf166fb9544621ffa43386d79647ffff50bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782144, "uuid": "3ff68106-fedf-43ce-9602-3b06604d030c", "comment": "Malware payload", "value": "42034011d4f7bedd220f0eaf12f369ec936e8a26cdac6991962af029b750ae71f494deb27c5872581611264cc542339b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782144, "uuid": "4673add8-78c0-4573-84c8-e41e71ea76bc", "value": "T19D138F392B52D033C55238347339D2B25E2D593220599686BF273A391FB03F1E6ED756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782144, "uuid": "1976b3e6-27b0-4235-882a-1e9b4f17f34d", "value": "768:ctgXTKIAwlv3UZyS0sHNkNuEaXsDXyYG9BbshQQw79ygslGCh359Kz:x7MLN4Fa+iV9Bb8QJUgs13Gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782144, "uuid": "eed7b37e-7455-4f53-875b-6fd244b1f099", "value": 43170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782144, "uuid": "21243280-569c-425a-80f8-35ba5b4d9e9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782144, "uuid": "87ff35f5-5b1e-462a-b7b8-70fbe07d99ee", "value": "51b6f7d56254b4ca7b6fcf9410a1af46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b703d7de-4d3c-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637768370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768370, "uuid": "9633febd-3cf4-4112-ba29-3f3fe5064375", "comment": "Malware payload (RemcosRAT)", "value": "3bb6bde6a9807c1dfed9601df82fb1f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768370, "uuid": "901aefde-30d5-4dd5-bfa9-bcc3f6868ada", "comment": "Malware payload (RemcosRAT)", "value": "a63fc1222dc9dd15ee1e31aa6775456eaf65394c69245149f2838817003e2c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768370, "uuid": "9f49587b-018b-458a-b391-59f28b8b366c", "comment": "Malware payload (RemcosRAT)", "value": "424f5cd4f250040411330f0c175eba803dc8dd6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768370, "uuid": "b7344ce8-d3d7-4c6c-a86b-cd457d1aca55", "comment": "Malware payload (RemcosRAT)", "value": "c1938c9f9d59bc5978f65c59d3cde37639bfb0a4fd643edf2d3453c4957ebd9e387ed79dde10310a558e4b7065e2d159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768370, "uuid": "c3f7ffe7-4107-40b0-9678-0e70294dffb4", "value": "T117F4123432E9635ACCB78BF40DA069890772A1153E25E34D9CCA66DF1D25F5A0F32B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768370, "uuid": "d7bfb6c2-6271-4fc1-9b54-c5e5c2c465f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768370, "uuid": "eebddb08-c9d8-4a49-b596-d441123761fa", "value": "12288:+uMT9f38z6CxM8IRC5ZQq2ockIAa0WGZYR4+yybcAtRf3+8tdkiRVG8A2wmQqytV:gS6CxM5CjQq2VkIF0tOR4+yaf3Z3G8An", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768370, "uuid": "1c3b3577-fbbf-4cd3-a486-c43bb7812adb", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768370, "uuid": "df8fc158-80e4-4954-a99b-8f326f9b4daa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768370, "uuid": "54164028-617c-4192-9189-6c39ae1a4bad", "value": "Quote Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694d775a-4d35-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637765233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765233, "uuid": "28be62cf-eff2-4234-8d37-98f961e8b4c8", "comment": "Malware payload (RedLineStealer)", "value": "ce7bd46338804ca5b1266567bb6a8479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765233, "uuid": "67ae7633-7d06-4577-a72a-90b15190d14e", "comment": "Malware payload (RedLineStealer)", "value": "a6f29870d7504de6650a95b708cc78e83e41d86acd61cabb230b45aea5161786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765233, "uuid": "b80c8a58-979b-49e8-97e3-82634b78d298", "comment": "Malware payload (RedLineStealer)", "value": "067695bcbf4fc134ec20f30bd6c1549da5625605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765233, "uuid": "838cca59-67d0-4fe8-a327-5b4fba45a10e", "comment": "Malware payload (RedLineStealer)", "value": "77e798c192292d6cf505aac4692b7402ddd0d5db239bb0c2908f4686f8ebc4bfe830867c7e8eee65b7c2e1412e54877b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765233, "uuid": "81e27342-caba-476d-a7ee-b56aca091dbb", "value": "T1545533BEF200FD5BD34DC738DA62D91A5D59A841946CD3AFE91E22CDF520F68962E020", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765233, "uuid": "b1ba5e2f-01f3-45a5-8b21-a089e5880303", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765233, "uuid": "c181df1e-47ff-4b73-83b1-fc81040a0deb", "value": "24576:Hdh5cQzsh8D3GU/cpThxi9Z0V8F2N1RPXGRWC9J7lQzDCqQ+lakEaHNYK39+K5D1:9hCQzzQpfcPF2N1RPXMWCODbQjNaL+M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637765233, "uuid": "c8f3fb88-58b6-48da-972b-279b26278dd7", "value": 1386544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637765233, "uuid": "b6589029-9f83-461d-8907-2faaad8e7bf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765233, "uuid": "31493576-f5e0-419a-b167-6b6a5f952a4d", "value": "CheatValorant2.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5b8bc4-4cff-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637742098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742098, "uuid": "b471aa4f-df6d-45fc-93df-a4d26e2af683", "comment": "Malware payload (RedLineStealer)", "value": "63c87debef2bd22f131e65e6b743f354", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742098, "uuid": "ecabf9e6-100d-49a9-ac70-673ddc3cc3f6", "comment": "Malware payload (RedLineStealer)", "value": "a80b954425ff5ca0144f08a5eebba59f821587bcacb8095973fa17a205482eea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742098, "uuid": "5c5edd56-cda0-4352-b2f8-e6ef96c22e74", "comment": "Malware payload (RedLineStealer)", "value": "18ac4e215f617ffa4ce56b51c43f8c36e9b80f2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742098, "uuid": "e722a65b-48b3-417f-91b6-44c925becc69", "comment": "Malware payload (RedLineStealer)", "value": "9a047e17bace9ea629b541282b30704040fc6d272cccef9f2fd49a45ed38417c59197a16f1bb7007fee1b93c0ec42efc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742098, "uuid": "7e5e5658-f0a4-4dd9-bdbf-64eaefab5ff3", "value": "T1F3C4E01547E8CBA5E7E64B38CD6241075679EA5B64B2E30A0BC0F02D3C67BD85E27237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742098, "uuid": "001ee0e3-2f30-4112-a234-04d970b2e13c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742098, "uuid": "7f5ba112-b9cc-479e-ad36-7a1758ad56dc", "value": "12288:AHjazjLKKyXjqylwVQxyc9lKKKiqgoQeYNwAr:AHjEuKy1SOxy2lNRqJQ6Ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742098, "uuid": "976d3047-ae26-4b4a-a8f6-ca121ba95ecf", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742098, "uuid": "04fff098-5f5a-4d41-af5f-54aa6acca173", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742098, "uuid": "59fe2942-99ed-4622-9bbc-141ef6490bcc", "value": "63c87debef2bd22f131e65e6b743f354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5080557-4d76-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637793331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637793331, "uuid": "a49e453c-8fc6-430c-975f-d091dc24cbeb", "comment": "Malware payload", "value": "9c9c81ef3929c0b6c9e23db9c0498986", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637793331, "uuid": "ec2935f2-c5a8-47e9-b952-f8acc22edc32", "comment": "Malware payload", "value": "a8446853349b7690c549cba706f60e33a5eee881e71574307cd1634130254952", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637793331, "uuid": "84782280-191b-42b6-be0a-02f9fed179b8", "comment": "Malware payload", "value": "64e79b5789639ec40453dfca21e76a7c22f9b816", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637793331, "uuid": "9008a725-acc5-44ed-857f-cad30a386448", "comment": "Malware payload", "value": "d1f692332d439de0bf6e021d1247d20ec4b3e4d6d944163dec15660626fac10a182b81ee061a4a72ea67da6d27032272", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637793331, "uuid": "695a68e5-051e-4fe5-af26-9cacb6ac35d5", "value": "T1A0548D11B5C39072E5BE143079389AA7096D79310BF4CAEF97D4093A4E742C1973AF7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637793331, "uuid": "0a0650c0-df40-4d5f-b985-cde55d840e09", "value": "6144:+AriSO7B4gYcl/qjc5dQD8JCedcsqAOBC3:+AriSOG9c0jc5mDQxqfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637793331, "uuid": "227bfeaa-7a8b-4ea0-98d5-20ea791dff83", "value": 294692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637793331, "uuid": "c6963faa-1425-4173-b7bf-1e15346de164", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637793331, "uuid": "ae4b5e1f-7bf3-416e-8521-b770324e7c3d", "value": "emotet_exe_e5_a8446853349b7690c549cba706f60e33a5eee881e71574307cd1634130254952_2021-11-24__223527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87a7748-4d31-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637763675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763675, "uuid": "e6880ebc-6088-4523-8edf-29dc95601234", "comment": "Malware payload (Dridex)", "value": "88a90ba05269dc5408937d421d107272", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763675, "uuid": "effc9d36-52c6-4a6b-9598-f578af5d33dc", "comment": "Malware payload (Dridex)", "value": "a8bc0c87149687f7d27e4c4aa6ed8afe4a18a6d1e958d237e11554485438d586", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763675, "uuid": "8901a2b5-b3e0-4dc2-bcf1-c6292fe05a66", "comment": "Malware payload (Dridex)", "value": "6e35e5f9208257959d820bb69fd01798fd040f23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763675, "uuid": "493a17ce-84b8-4041-9ec8-a0dfeacd3168", "comment": "Malware payload (Dridex)", "value": "bc74428dc00cc5e2a86a225d05620469ec287629e6d798ec171b710b860725e7d85644b4e7d0b23d30798132c537208a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763675, "uuid": "5f57c226-a25d-4da3-a77a-a38c691bf5ed", "value": "T10E63F1458B59B8B4C2FB14BCD1189EF17147571C5E96E22F24B8E628E8207DBC3ED328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763675, "uuid": "abc0e3e4-5bc5-4ccb-93a6-70ff939268cf", "value": "1536:UWQPqrE3gpMokPF58Ik4kosQFVvSuMEMFWuw/xgdseW:VREwFkd58IXkOFVvMEMtw/xgdseW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763675, "uuid": "1d1b8908-525f-452b-b3ee-17d54e2819df", "value": 66973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763675, "uuid": "024ce0b7-edac-403f-aafa-990b05dbf40b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763675, "uuid": "26a5fa55-27a6-450f-9166-c3a7cefb2d36", "value": "permission73815.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47379ed-4d4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637775721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775721, "uuid": "cc0d377a-c13d-424a-b5c1-bba22ae3b997", "comment": "Malware payload (Dridex)", "value": "bb6456b2119cd5597d4c5095822b78a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775721, "uuid": "7656d16d-a9e3-4a1a-982c-784374aa26fd", "comment": "Malware payload (Dridex)", "value": "a8edfd808c0c30de4cd92a88528896b199611715c77758644fbf4ccfdcc113d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775721, "uuid": "37952e6d-f7d2-48d8-8656-5be80792a932", "comment": "Malware payload (Dridex)", "value": "6dff6f559d93d16b1c5266ee4663fe592061146b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775721, "uuid": "e6e57728-b259-41bf-a5c5-527afaafa9c9", "comment": "Malware payload (Dridex)", "value": "1e72ed6a7851820eca231f15e87ccbe56c41ca0d4ae3411c83d3db09e73e168a28b767c6058b33407bf862e6d1eedae2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775721, "uuid": "6f3bd226-6850-4ea1-9be6-3059ae215d01", "value": "T1CA83024D8D9431A2DE81EF3E470E18E3B43527566D21998F14A8EED80BA7153AFDF207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775721, "uuid": "073e1379-24e9-4b31-91cf-58664039f95a", "value": "1536:UWqPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5h++51Msn1M8gHtgdm/e:VSqmc3/q0dfaguKyX5KFHtgdm/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775721, "uuid": "1838f21c-1de5-44cb-938c-97acde512e55", "value": 88232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775721, "uuid": "5f849995-0cfc-42dd-949b-51b5f77b0e1c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775721, "uuid": "94358e3b-8e46-4e5c-8b90-875dfdaf922e", "value": "tax-106609.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc92324-4cd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637723261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637723261, "uuid": "83e1072c-791a-438d-a69a-fffab164b9d8", "comment": "Malware payload (Mirai)", "value": "775d80b2aed7af59155fa3dbe6047e2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637723261, "uuid": "66ef6aa5-1976-40a2-a331-77e9bf27cd6a", "comment": "Malware payload (Mirai)", "value": "a9b55fb4297819f6e352eb0df9f11630478483b3e39eef7971cd10899a30dc2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637723261, "uuid": "0c60468f-e6f6-4b12-8661-2bcdc7bedaa5", "comment": "Malware payload (Mirai)", "value": "3eda5a4cb58e3e4376fdb446b5302559b65eb8c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637723261, "uuid": "177c73ad-1014-4277-bbde-c800dc2f8604", "comment": "Malware payload (Mirai)", "value": "d20456c9bde036b3783839567b306942bab1e6cdeb6eb97abe17d63ec6d2811c52ad595f3c875d83e3de09376d6c35a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637723261, "uuid": "f7f05a45-f871-4f94-aeee-e429a35194f3", "value": "T1AE735C34A97D2F16C0D4B17A62F78751B2F6220E2AB0865D7C720F4FFF34644A8562B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637723261, "uuid": "63f3ac8b-0e3b-4660-bee2-64fa44906774", "value": "1536:nanV3HoEuW5WzR1YznvIJgLWo8K142cTcvGB56vZ25PylNFFU:oHoEuW5WzR1YDxcTcTvZesRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637723261, "uuid": "a27fb53f-b7c4-4e14-8aa4-5bac20eb7b77", "value": 75764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637723261, "uuid": "eedc734e-3b26-4ba7-b72d-c63cc678178e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637723261, "uuid": "52e0487c-2453-4ff7-b790-72ce6caa7b42", "value": "775d80b2aed7af59155fa3dbe6047e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4bf659-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637774472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774472, "uuid": "a820f9c5-2f7f-4953-9a53-aa1af5d2388b", "comment": "Malware payload (AgentTesla)", "value": "c615292324b9e95e5082f3963ace1557", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774472, "uuid": "e61fb4ac-5b13-481d-9117-e9c0571dc7e9", "comment": "Malware payload (AgentTesla)", "value": "aa829e03b11d814611470d423a88b2aa773451313a8965ff3b3aaa88e9421511", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774472, "uuid": "fec05945-1802-411b-97e4-195f30f81f0c", "comment": "Malware payload (AgentTesla)", "value": "99a8c18f4bb76a6310e93c4bbc1bc4cb18609475", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774472, "uuid": "f2bb25ee-7d11-4b72-8d34-cf50f0257b8c", "comment": "Malware payload (AgentTesla)", "value": "b23204d1280fc68d13eb6b800e748188518b68782dc8a9b68779bc7447e74e99f728a025d8773ac186897e4a81f69b74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774472, "uuid": "d248c7ca-b045-491a-b6cb-6d6cf9803ca0", "value": "T1CCF412B632A46B6BE9796BF40C40228013B261153A15D76C6DE953DF7D22F134F13B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774472, "uuid": "9d6febe7-0880-4ca2-a446-2c5a71e9f6c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774472, "uuid": "eb3bcd05-3b68-413d-b859-a22fa1e33056", "value": "12288:Ubn6f4yq+HYSNWXLyWWqzuHdj8GchsGwdbEKt2xnsqa1I7F3MYPBwGr+HZdMn:Ubn6f4yVDNEiQG/dbEKoxc1IZpxyHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774472, "uuid": "a8f271a1-67fd-4d8e-a6de-a829c528a003", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774472, "uuid": "2ba37fc0-b2ed-44b6-b17d-568cfac82fa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774472, "uuid": "73544088-98d4-410b-a5cd-fef01f3468ae", "value": "234567TAsCrdA8RO0UKcU9876576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c4a6c3-4d6b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637788358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788358, "uuid": "b0eccd26-7e73-4928-a742-3d5a07d45075", "comment": "Malware payload (Mirai)", "value": "f996a7c1f2bdcb1e5ec5c22ab70a1b8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788358, "uuid": "a4052d57-6eff-4f54-ab22-e8c7f8185ae3", "comment": "Malware payload (Mirai)", "value": "ac7308c14e69f24ec5da66170d985b0de1199689e17fc8b9dc45205a16bf022a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788358, "uuid": "8d790a15-a1e7-4221-bb77-5a0f3bb64e0f", "comment": "Malware payload (Mirai)", "value": "706b7f183f7f6ef75cf13b29b6c64568666b2ffc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637788358, "uuid": "244c30a0-0577-4505-aea0-3a9e8a2f38ef", "comment": "Malware payload (Mirai)", "value": "de2c6077aaa5140ca850016a69cd110eb6a28d7b40a9983d3f727c56d3f1376293585d4892416d3c883241815445f21f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788358, "uuid": "8ad24a36-1866-4e22-a54a-cbbc671bbc05", "value": "T160539FB6D05EADD8C548423CA5254EB91B13EA0582632DF59ACB85F1804BDFCF94E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788358, "uuid": "05c9d113-1a51-4522-b859-6ffaaac7259c", "value": "1536:iaVdJpOucPwtSDx/qAzS5tYNirdHp/jQdqjCs:ieVOtbFiA4MirN9jQdqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637788358, "uuid": "2cda57a9-e985-4142-9397-01bac11327b3", "value": 62696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637788358, "uuid": "d733932b-7946-4035-91a9-b929d8c9f92b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637788358, "uuid": "0785eb90-1cd2-418c-894b-028b9cdf8b9b", "value": "f996a7c1f2bdcb1e5ec5c22ab70a1b8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbdeaa5-4cd0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637721860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721860, "uuid": "f7c3d14c-fad3-4714-a17e-e045c9b11d40", "comment": "Malware payload (Mirai)", "value": "7a316b56b4798ff09d06e2082358cbf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721860, "uuid": "669572c8-2e5b-4567-a3dd-5d2a52b17ed7", "comment": "Malware payload (Mirai)", "value": "add1dc690f580a47421ed69a459792a10f0e507073455eab598f6c97760824b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721860, "uuid": "34374d4a-69ca-4d4a-9891-b452b0c91061", "comment": "Malware payload (Mirai)", "value": "b29e3c6364e64521e88b98f23d83268d5499eef9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637721860, "uuid": "89fd3743-2eb7-4e10-ab18-42ceabe72d55", "comment": "Malware payload (Mirai)", "value": "4d80b2571bfbb5d625d2c299cb5d7a677af123bbaff86ef89bdfb5428bfa01279a0d91b98d1afc15039c1a66dedc618d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721860, "uuid": "9024b86f-59f7-473e-94c9-f3bcc35c3b49", "value": "T189534B0277584F0BFAE61AF0283F2BD483AEED9025F5B584690FD7454635E33498AE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721860, "uuid": "709a8c3f-3c09-4534-b1e8-98f0634a7a48", "value": "768:Gqt/pKS5kki4+uIioJXYRbviJZEYEk5V3JeEP6+17W27wEsf4qqDs65PEBbsVS:t9pJEKbk5mCntZ3D/5PEuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637721860, "uuid": "f843f168-cd2d-4fdd-a374-7d0eefdb9e13", "value": 66476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637721860, "uuid": "e3441602-5c63-4d37-86b5-4aa6213be8a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637721860, "uuid": "127d4f05-4a08-4b24-b80c-300be026c0da", "value": "7a316b56b4798ff09d06e2082358cbf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaced4e-4d20-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637756328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756328, "uuid": "d3429705-cbb6-4d35-8b2d-71424ae876b7", "comment": "Malware payload (Formbook)", "value": "a4f0e03bfddafc4edc2ea4dca18de602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756328, "uuid": "338d3735-594b-4408-b2eb-0d14fac01806", "comment": "Malware payload (Formbook)", "value": "add49ff90e9a5f990e780c12d02b2bb16ffe75d4655f9e5e72cf227b990d53fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756328, "uuid": "b34dbcf2-d65d-4a5f-a9eb-ad137fe63000", "comment": "Malware payload (Formbook)", "value": "b01b3098902f4977827c020e573d8399653548de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756328, "uuid": "61ee7a8a-741b-475f-87f8-5eddf14f8bd3", "comment": "Malware payload (Formbook)", "value": "d8a58dd8e090c36ccb48fe3019e3f4e52b53fc4df202468c3c13abf6b537d6c9715ceea31fbda5801f5ee41030c94e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756328, "uuid": "35d8fd51-5e39-4ce6-8c68-1d7e8321de1d", "value": "T17B54228575C08633DE664F73097F7C2593FA966C82441A130B613FAFAED32C5881A3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756328, "uuid": "81b8fe33-3477-4cac-963d-cf1a7a3d76fc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756328, "uuid": "2e3dd257-c696-4963-8829-f826d9ac2dfc", "value": "6144:rGia0yP6ZINUQQUXe/hbyakFP+QsW1lndJidd6sGAfsHrMUzpl0:+7NUQnutHKPvsyLJiXxtT4/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756328, "uuid": "884f4cea-4b5f-42fd-b0d0-6d9656947122", "value": 303948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756328, "uuid": "26de9405-d2ca-444f-8320-d7cb382e74a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756328, "uuid": "96818dca-fb52-4403-89b1-d592211684ed", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87d7c8c-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1637782600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782600, "uuid": "a6ca276e-2ef2-4f3b-8bca-fed4c57c299c", "comment": "Malware payload (Neshta)", "value": "70249955e9e48bdda0c0687b70999a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782600, "uuid": "06465542-23fe-47ec-9bc5-43cf1d21a894", "comment": "Malware payload (Neshta)", "value": "ae27369e82861c261ef0827edef24f8bde12f0028c239b92a21d67a4b5fba338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782600, "uuid": "d7cf415c-03b2-4334-913d-df84e90c6e48", "comment": "Malware payload (Neshta)", "value": "dd11ca5e947fc96456676cf6e97d4e3ed8e80e98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782600, "uuid": "dea74f3b-925d-4676-b4e8-47fea862ad80", "comment": "Malware payload (Neshta)", "value": "85085943b4c4f568560b2a8f1c8cb424b4e79660a349de0e4442d0fafdad58ed170f0991fcf94f126f25f240768200cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782600, "uuid": "866b065f-a60f-4603-8204-dd1bfae08cee", "value": "T184D40254779867A7C87A5BF20C3190D503B2356A2910DA6EACC936CE6C36F061B12FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782600, "uuid": "89f89060-77b3-40e1-979e-7e4850260944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782600, "uuid": "e015cf16-89fa-49bd-b55c-4cf9ae5801c2", "value": "12288:otD00KRa8tJh0DZP+tmw34VJY1XqE0Tjh3dRiO:oC0SVtM8/o7YBmf5Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782600, "uuid": "751ff3ef-7ba6-4b34-bbeb-35dd4e9befdd", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782600, "uuid": "99d0edc1-3e1e-478d-81d4-903cd9ee6a66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782600, "uuid": "a39ef689-e08d-433d-a0f8-980bfa894169", "value": "70249955e9e48bdda0c0687b70999a51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7f86df-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637772540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772540, "uuid": "05b12f2e-b9f0-44c5-84dd-9a9b8ac52963", "comment": "Malware payload (Dridex)", "value": "2c9a177b6a0e43042a46454f467d3aed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772540, "uuid": "fc09ff46-7683-4167-ae48-90c65ba872cc", "comment": "Malware payload (Dridex)", "value": "aeb5ba1012635aac25405662d49fb4cee984b6022aa97cf3acc21e505b37fb2a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772540, "uuid": "fc2f3525-c269-470f-be94-a90d3d845c69", "comment": "Malware payload (Dridex)", "value": "d57674a7abe5914d4621d75d8f415116326c82d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772540, "uuid": "ffa2649a-5b44-4ce1-be8a-92bcaba18def", "comment": "Malware payload (Dridex)", "value": "e0607a1dca7763f199574e388adfc814b7f1b9e7f6a00364c2a096e7924d93ad27e4a6788c4a06af107f549d697efe08", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772540, "uuid": "c6093589-6850-4161-9dbe-9013f866a4f8", "value": "T1AAF49F04160C81F2D13EB8F99FEDF291CA3A6F446169D3F8B65662C170C76E5221E78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772540, "uuid": "60f24733-c525-4641-968e-2ec1759d7638", "value": "d179952d1193e1cd0ba3af2a8e8a650b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772540, "uuid": "5edee030-a5a5-44fe-83d0-d57be94681c4", "value": "12288:b1/g8A8wcY0yUcQkQUW0QAa0SSMuCAe2UiaUWQIqGQmy0ymkxceCalbcyZ8fiYBo:hucRalbcymf1BFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772540, "uuid": "13065329-2f7d-432c-aa50-b19d663d37fc", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772540, "uuid": "7b6793f0-89c6-44fa-854e-07802b39b04f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772540, "uuid": "1bc5f6cd-206b-404f-924d-c7edbfa0c7ff", "value": "SecuriteInfo.com.Drixed-FJX2C9A177B6A0E.11375.20497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f872eab-4d37-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637766022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766022, "uuid": "737a5095-9893-4fc6-9348-5609fc473fa4", "comment": "Malware payload", "value": "9786f0d4144dc702af9e81dd21048c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766022, "uuid": "beab9947-4235-49a0-8ccd-41b547f7fe9c", "comment": "Malware payload", "value": "af03caa4ceb5e6c730e93a8959faedc9e0547194471265f77234d37554c13849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766022, "uuid": "c14ddd30-1588-4ff0-82ab-f9cbc6ab70b3", "comment": "Malware payload", "value": "7c9431f49a728dd3d15b4b40713e65dcb2d60892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766022, "uuid": "c7823349-ea53-462b-9b52-8356ef70bb33", "comment": "Malware payload", "value": "9db216019524ca9876a0e7cabf897f62d729c598696a1aa187152e0d005d42a2f52ee6af436d905e1144e7e8fcda52bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766022, "uuid": "4c5a70b0-8fb4-4619-a541-b7edc9723999", "value": "T1F2E533602A9261CEED9BC275DA5CA9F51660BE4F2A60F69875C4DD0DBCB2DF302D4038", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766022, "uuid": "24245aa8-85cf-4bee-92ea-3c543969f540", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766022, "uuid": "3f5eb48e-d556-48af-a4bb-c54f42348258", "value": "98304:WXTuDwWXBo8vH/lLiwN19+NkqOH8n8pEjOGChIQs:WXTiwoact5q8s5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637766022, "uuid": "5aa7df48-7b4a-433e-b2eb-a682a2c5cf91", "value": 3290384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637766022, "uuid": "2df0dfce-7492-4ac9-aa2f-5578b9491ad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766022, "uuid": "285dce07-c7a3-4b78-b415-ca240182a692", "value": "aInjector Win64_x32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a087878-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637749638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749638, "uuid": "9ddc4096-3f85-40aa-b7a9-836f6ff1a518", "comment": "Malware payload (AgentTesla)", "value": "069f0e34c6a13996ec5294e6d5af5b73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749638, "uuid": "02a5f697-812f-4c6e-81f6-94cae3b19b8e", "comment": "Malware payload (AgentTesla)", "value": "af1156270206dd817ce5f7f49e37c6733c5522ac273d53b1611a4130b36c252b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749638, "uuid": "69af5ea8-7834-4b8e-a853-9f7533b4ccdc", "comment": "Malware payload (AgentTesla)", "value": "f0e1da0128dcb2fa52cd330a1f84cb41242d7ec2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749638, "uuid": "e069005c-3e3a-4205-a810-0e8718b6121e", "comment": "Malware payload (AgentTesla)", "value": "c0fa89d0021a13ccb196420e13a4cd34caf9ffe5e0b3b7015a5d10326ef85a49f4d27164d3b41750acb63aad6781a5f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749638, "uuid": "7cc5a517-b60a-49da-b2ba-3548f8ec38e8", "value": "T136A401313294639BCDB60FF91C6026C963B135107E05D79C4DC9A2EF6E26F264B12BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749638, "uuid": "16548962-d9bb-4c4f-8937-a2622fd90ddc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749638, "uuid": "055ae336-e785-4e58-a386-5dad795c4c4a", "value": "12288:ikNCIfEtBLXzKIyN9Nz4xBDEXVqJiYAMYY/jatPHtWfXUH2:rQCi9DKIyN9Nz268nfIvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749638, "uuid": "a0d01290-b043-4713-b739-81ebd64a3664", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749638, "uuid": "9b105d64-8a38-490b-9b66-782cc61eddfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749638, "uuid": "684d766f-3288-4ca5-8953-892270f9bcf3", "value": "Tender notification_24.11.20.21.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e7a9f7-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637774764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774764, "uuid": "2193d787-d43d-4b95-91db-7fa12e544084", "comment": "Malware payload (Dridex)", "value": "85f81634f3be93b8e2d359f6e8b0fb86", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774764, "uuid": "654812f0-e433-47ac-b459-72513cf18566", "comment": "Malware payload (Dridex)", "value": "b014517509b62e4213542031bd66467eb666f981270ee24b77aac0b62116b347", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774764, "uuid": "1e521b95-9505-4a15-9396-cc937750d677", "comment": "Malware payload (Dridex)", "value": "348022012f0fefb9365c2cd243a3ff10be7f6a51", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774764, "uuid": "90034c86-61be-49ef-ae39-e48e2104023a", "comment": "Malware payload (Dridex)", "value": "299d1e67215e1415a3693731cf12dff87cf91946ee1e0a7198b1c6630d2499823857206f9b1f90f5d1ec0ff607c05069", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774764, "uuid": "5f3d7109-e7b3-4f1e-b7ef-f4f73104095f", "value": "T1E7F4C15536FA19A8F3D8A27AF64019A12A5F830D10BD8AC05EB07C710DB6FCE55DA0FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774764, "uuid": "1be1eca2-8235-4334-a03e-2c9d00dcc969", "value": "90b59c6ea388daa7b6008a55178494d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774764, "uuid": "5b1cc310-044e-4676-a538-c79d6463a222", "value": "12288:a3rRXZOdQwBEyG1vrCUKgmB5iz54cb5c4v5W8z5+sz5scz506n5+ez5oG15ouv5w:a31XUc4g2iz9bhvJzRznzbnzzX1Pvxr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774764, "uuid": "0f6a2d4f-9259-4045-a85f-1b30f028be16", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774764, "uuid": "74edb77f-d466-4cb0-9496-a0313352cf95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774764, "uuid": "b30b0c8b-e823-4bcb-a279-1963d325a943", "value": "85f81634f3be93b8e2d359f6e8b0fb86.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1729423-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637782588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782588, "uuid": "0015fc2f-b9ae-43d5-bf2c-099dfe035a6a", "comment": "Malware payload (ArkeiStealer)", "value": "7cbc2100b9698ae41f88e0cfbf6037ae", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782588, "uuid": "6c043f6b-3789-4ee4-ac39-6a12ea1537fe", "comment": "Malware payload (ArkeiStealer)", "value": "b0ffdeb93d45ef22371b46cf607a43a75e24568a9bc784187489c0761c3481ec", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782588, "uuid": "d03e530e-c41f-4ce3-bf8c-f26da79c805e", "comment": "Malware payload (ArkeiStealer)", "value": "8fa3993b7782a8cb8c117f8a7457af7b4f0c2eea", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782588, "uuid": "87b13776-5c99-4205-90a0-b986bdd3f57b", "comment": "Malware payload (ArkeiStealer)", "value": "d76d601bf9cbe0e43c6b63e76c055b9dd237c4a1f871430216b993d79248fd654df23c75481aaebb0f529940400c6dc3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782588, "uuid": "b71bdf29-8e92-4e76-ba16-491ff253392f", "value": "T13F14CFD275E08031D8D7E2B028B186B91B7D78222775418FE7952E2E1F7E3D08A693D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782588, "uuid": "25d04a1a-28e4-41b0-b722-92f4871e905e", "value": "7fa5c9c2dffd615fa15cdafc116d6f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782588, "uuid": "1c567ede-e45a-42b0-b923-37c0af1b07b0", "value": "3072:WMeeihCiQZZpDlYPHjPxZZZslmCwfXXVYb84KMday9llP2:WMihCiQTp54HjZZZ7VFYOMd5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782588, "uuid": "7911d5ae-2207-4f74-9160-4542d87ef295", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782588, "uuid": "b37cf36d-6741-419b-ac71-026c89507065", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782588, "uuid": "9ba5b80d-2183-4cfd-a775-4eb4bf12b331", "value": "7cbc2100b9698ae41f88e0cfbf6037ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d70ec2-4d03-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637743805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743805, "uuid": "041d6e6a-f95f-45ff-9bc7-382f044f3d32", "comment": "Malware payload (Mirai)", "value": "f10c74721efc3e0a4f67ea17a89a856e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743805, "uuid": "79038014-3189-4963-853a-ce825bedfb34", "comment": "Malware payload (Mirai)", "value": "b14b98f15346a8f5dbb08bff06f493a79d297ecd4674a2dc48192e044c482047", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743805, "uuid": "5f7c4392-12db-41f0-8814-118bdf509ab0", "comment": "Malware payload (Mirai)", "value": "a3ba53178fd2db28607f13572635338ce1fec627", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743805, "uuid": "b67127f9-eac3-4fe3-9a9e-b079e49db78c", "comment": "Malware payload (Mirai)", "value": "c1909bf3da4a44171bc2fe3c38149fd2eeb35dca7c07925245fc6a8308a5f1d2fffe996d1fc5487a9cb683d7fa27d114", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743805, "uuid": "1c0d07c9-f07d-42b5-bddf-d47269e982d5", "value": "T12D144C86DA804E13C0C71B76BAAF414A33229765E3DB73069D14AFF43F87A5D4F26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743805, "uuid": "d8641145-4c7f-440b-9d1a-c211c4f5e691", "value": "6144:1B2b2a8mzKQJaAONEEZgDYXACpXqRuM/9v/mqwhDMSUgV:1B2qtlQJaAONEEZgUQowf/B/mqQDMSdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743805, "uuid": "dc1b1599-269a-4a0d-b626-547ae25960c6", "value": 205505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743805, "uuid": "884772ca-044c-4277-8bb3-410e4e1e1068", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743805, "uuid": "04379034-fcfd-4839-bd81-cbc6822ba311", "value": "c0az1l4js3001lsk4xd9n.arm7-20211124-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a0af57-4d25-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637758273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758273, "uuid": "3d5a0034-a797-43e8-acb4-8491b49e3af0", "comment": "Malware payload (NanoCore)", "value": "d1edb7cd80f20347fa00f25792241ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758273, "uuid": "693eb8f2-679c-4c4d-abf9-7534090135e4", "comment": "Malware payload (NanoCore)", "value": "b186f6738901b0cf5824a3e3789af05342f414f30ad10d615a2b1a4203280627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758273, "uuid": "bbe88988-c7b6-4aad-bf9a-30a4bc7d5dc5", "comment": "Malware payload (NanoCore)", "value": "63c1bffd57bb0e4cc32c53eccce4916fea2af18d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758273, "uuid": "12539024-9675-4424-9209-68421bb3b8a8", "comment": "Malware payload (NanoCore)", "value": "c1db574a4129917124f0fda9b49e013db958c51c9f6fcebe78a69a1f74f9d6e2b1abfedd9bede21b6c1a78ef6c82a664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758273, "uuid": "5774fbe8-af6b-4a25-859b-4aa77c01ba57", "value": "T14CD40225326877B2C8795BF10C71A1C12372B62B2511D72CACCA65CE2E31B155B63BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758273, "uuid": "14ece32f-301a-47e8-86ed-695614484bef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758273, "uuid": "b0172ab0-9e10-4eab-942b-79c140f8097e", "value": "12288:ZNtD00tT0tvUHZMzxSC3rZc9/iz0YhmeBJv3ej9KUrx9jgrv:3C0tqUESOrZ5game3Oj9fdGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758273, "uuid": "877de6be-22b7-429c-ab86-19d6bdc4f1cc", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758273, "uuid": "83ed1cdd-631b-412a-a9e0-8f0fd8a0896c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758273, "uuid": "84c2154b-1ae2-4d0c-a3ca-2b430e1136f4", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb09381-4cc8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637718315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718315, "uuid": "3fbc8698-5d4a-4d15-9bf7-da3f844e6758", "comment": "Malware payload", "value": "45203007a4b84ed878e9f66ec1b05bd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718315, "uuid": "34478132-3151-42f9-8351-3d67e3f62e69", "comment": "Malware payload", "value": "b201c48281c435efba27e323eb5c301c54344598f28fd09981c18797a12ac458", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718315, "uuid": "3b7f98d7-bf72-4e68-9e1b-576a6360f801", "comment": "Malware payload", "value": "43324f70f713b2047eab6cf9196a187852753aa9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718315, "uuid": "8a3b0845-13be-4870-8b23-c340732ec80b", "comment": "Malware payload", "value": "5cfc1ad1561907dbd4296312a68a831e39007dfb2ea3dfb9d4a8f4c56e0ece88c9ec0d4487dd313e2db7630e2fb5dbe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718315, "uuid": "86df7fb5-254a-4aae-b0a4-4acc0d3e2b81", "value": "T1BD457C0C22A39E1BC2B51AB7852EC251C6E29B0D2165F317F6FB01636F5B3B54AD63C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718315, "uuid": "77c61817-4ad7-461d-a95a-6b5e364882ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718315, "uuid": "e20d1d12-628f-48c1-800e-9143c3a2ec24", "value": "24576:/gUU6FsXqCpQd7IbLm4aoc+2q+A+Vep+L+7bhcW:NLCOB5ch6VjL+7bP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637718315, "uuid": "3ad46b00-0d1f-42f0-8b2e-23ebfc787a83", "value": 1272048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637718315, "uuid": "a97d10ed-b0ff-4ebc-9af4-65b81e593ba2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718315, "uuid": "3be4fcfd-6b4b-449b-b598-c1f8eebc0519", "value": "45203007a4b84ed878e9f66ec1b05bd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caaf2594-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637736620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736620, "uuid": "bfa43062-de59-43d1-b88c-e75609fb0a9d", "comment": "Malware payload (AgentTesla)", "value": "b4948c6cc72ff921e18cf1c36374c712", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736620, "uuid": "32677726-1f09-467d-9836-b8078bf2c393", "comment": "Malware payload (AgentTesla)", "value": "b22cde1e2d6bc7eb7dd54d804083f7286607668cce5d965ecdaedeb78ff8c08a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736620, "uuid": "d404c951-d1e0-479f-b7ac-0eaccd418dc8", "comment": "Malware payload (AgentTesla)", "value": "ec7e2b2cb54173bb33d3117bd7a2ebb54c339699", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736620, "uuid": "afc158fa-53d1-4d2b-a6b4-4883c81d17b4", "comment": "Malware payload (AgentTesla)", "value": "dcec2942f722902188457661c043064d2a44910baf2676465047ca9a81a58a08ef301ef950c4440b887beb7a5b8bcbd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736620, "uuid": "ad38af32-5684-45e3-83e6-f2bcb9b59175", "value": "T161A4E04029D9D299F87FEBF51CB4B1C90739F2E5F881F1DEED90685688A27844F00A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736620, "uuid": "259ec6a3-b0d7-4eab-b2e4-15e67c6d1e2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736620, "uuid": "4177075a-0cfd-4f41-b9f0-93302d969e37", "value": "12288:sKJNr7fLAo4U/mJ/fvpBpMgnIhbE4W2XC1:sW7f4vHvGBBlXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736620, "uuid": "bb731915-960f-49f9-9c7c-765a4151f568", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736620, "uuid": "4f18c841-464f-4874-a22f-273d9228aeb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736620, "uuid": "a4bdc5f8-16d0-4da2-82b2-329430a3609e", "value": "Payment advice. pdf.............................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9ccb2e-4d57-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637779926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779926, "uuid": "828d0c54-390e-4aa1-be9a-96baf7e72044", "comment": "Malware payload (Dridex)", "value": "a6fa2e86006a76b8f28ec150a0ad761c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779926, "uuid": "d9a5927b-3386-4b25-abc3-d3679da7a876", "comment": "Malware payload (Dridex)", "value": "b2b398374fed09425fb6fe6986b77977b221a9160f3dacc5f5cb01c99643b8d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779926, "uuid": "7200e1d7-04d3-4c9f-b033-599e3dc83983", "comment": "Malware payload (Dridex)", "value": "377f22ec99f67ca380ca61f6c5732fb2b8e426b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779926, "uuid": "4f52b4de-86bb-4fb9-953d-231ea4cd1f02", "comment": "Malware payload (Dridex)", "value": "a0e47ce82273d08b3b9c22581d421ca1d197c98edc6beab9f27bcd5a3a1e14214a427cfd5406ec83d13835fc92778c31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779926, "uuid": "05962821-a6a7-48b8-8b3b-26d546dab17e", "value": "T1BEF49E3375711882E55213F9C8E53372DF17EB8588D01CD90F98BA9608BADF9A8C9DE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779926, "uuid": "b802c221-f3d0-43f9-a724-399485536ec3", "value": "aad41bc76bfe216cfc48b81f52e4aae9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779926, "uuid": "3714e359-8078-428d-8ad9-2c81e2a9e2e7", "value": "6144:xIiOww28O6OKaSYqiI4wgYMsXvKVE4C8WDOrIyiafz0AyeCEkTjFtRg2rQlftW9Q:WXyVrpWOrIRvBFw28RtGkl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779926, "uuid": "5d25a175-d0eb-419d-aa49-90d6e6031e93", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779926, "uuid": "bd3c8bc6-2e52-4ac9-b5ae-40a09a50f5b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779926, "uuid": "cfa9350f-8c2e-4a14-8c2f-ce50167971ea", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.20268.31276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693da008-4d75-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637792721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637792721, "uuid": "ad0a4019-c6ed-4a63-943e-39a3c3296754", "comment": "Malware payload", "value": "c4216e82e3466d99fa918af7c6be1a0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637792721, "uuid": "7e8a15f1-fcc5-4c66-93c2-d690e14a2c60", "comment": "Malware payload", "value": "b31348ef7668de1e20201be9ba36afeff82a97215ab83086e54c17dc1e8ec74a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637792721, "uuid": "661568da-d185-43a8-bd2c-0d288c0ac4b5", "comment": "Malware payload", "value": "49a6a2383b2d2f2d5a370edcd2edd40f81bd9521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637792721, "uuid": "146b5064-98bf-4190-87e7-fa6d52c438ee", "comment": "Malware payload", "value": "7d1b5567c4635f3b8d9f3d84400f660832c8959dd9a480251007e744cc10ce8d428958477ecc2b1474696e2405d5223d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637792721, "uuid": "8f07fb87-b312-4975-9eec-1625cd08d6ec", "value": "T1BA95335BA9B8B089FE68C5B7F7972151E8B4F4394019FCD70BB80AA13219D5F25F6083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637792721, "uuid": "2191ca7b-56ef-4c86-a888-7dc38d9e0047", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637792721, "uuid": "f5766577-d507-4ec8-a255-10d7709c0694", "value": "49152:00zmExl/LPmT7n3yK/ySeatXELYfYFWoaIv8:00zhj/LPmyVm0LJWoaIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637792721, "uuid": "60389d20-1d3b-4113-bd01-0d7e1181e8a0", "value": 2041344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637792721, "uuid": "c00031fb-798a-43d3-b09e-bf730b48ee26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637792721, "uuid": "4a6c19da-0b37-437c-b3a4-47baffe4e2d6", "value": "c4216e82e3466d99fa918af7c6be1a0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea240c1b-4d30-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637763302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763302, "uuid": "23a4ce1b-4a75-4e3c-9946-be2bd15e3347", "comment": "Malware payload (Dridex)", "value": "856ce8cc4ec2233c476e30c12bb4bc60", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763302, "uuid": "c56b0b14-d120-4063-a6de-785e0002c495", "comment": "Malware payload (Dridex)", "value": "b3e3c4008841cbaaa9a0c26b143f7a7ea1a9b6ec5bd66486a1ce694fba603750", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763302, "uuid": "6b262cea-a92f-4d4c-9862-d9ff6b6bd8cc", "comment": "Malware payload (Dridex)", "value": "baefd14e78fe2b37459cb6f523c6bcc92c568bc7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763302, "uuid": "eb476028-7e59-412c-8fb8-db4d2ccfbadd", "comment": "Malware payload (Dridex)", "value": "ba7c0e346e13eeeb8a23905e4320d3519eefebaaa9e6a305006a2311df648e79bbeaf8b4bc5d39996cdf286cffd1a97d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763302, "uuid": "5a0baee4-8fec-4e62-981d-cbaae17fbfea", "value": "T11BF48EDDB428F3DDC1A41B3312601B00594D7B9C964B28A9EEAB7CD5E2F4DDAC8D84B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763302, "uuid": "a6e84e90-a288-4657-a54b-0013bd527367", "value": "8c0e65d990aa46afbbebf4269ca1b019", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763302, "uuid": "e288abbd-a242-42e6-a857-498fcf507999", "value": "12288:pgUMGSOMwSG0umMqCImuoOQa0W2KUdgV+2CFDLhbUy0+j2Xf:AVehIPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763302, "uuid": "ad978701-2e45-4cc6-9555-7cb9ec235a27", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763302, "uuid": "d5361731-d5b3-474d-a7ca-a385da05acd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763302, "uuid": "751d4fd6-4394-43e5-bcf5-769b759963f8", "value": "yukxxxer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc61d9a-4d36-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637765533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765533, "uuid": "d5465bc2-7c7d-4b50-8681-4647ba29fbbc", "comment": "Malware payload (Dridex)", "value": "c228cd46ae66842b76254ecbd792a13a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765533, "uuid": "807292b5-2059-42bb-995d-b30e738bd605", "comment": "Malware payload (Dridex)", "value": "b40576b58877a5fd59bbe9d7e6ba66a296631ff13a9d9d5f0ff88ad374beb604", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765533, "uuid": "881d2472-49eb-4c15-aaef-c04dcc878993", "comment": "Malware payload (Dridex)", "value": "692db936f8c7cbd7af30427aef3ec12fdede21c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765533, "uuid": "c5aac803-291a-405c-8148-86a82be302d7", "comment": "Malware payload (Dridex)", "value": "802d7c73473fadb3eb63fcf1e14345d0cd680552fd10b30de6430ec1b18b25ffb16609d8f388c34733f2b9d4dfdecbfa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765533, "uuid": "2d036bf2-1fa0-42c3-a67e-8c67f0de34ae", "value": "T1F863F1ADD650B448CAB9743DB44F1EF1A95A9C0572D0C2DF18ADBB08076399B2F0E63D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765533, "uuid": "61a87710-8de9-4ff8-a7b3-842685e1c98d", "value": "1536:UWZPFwJpvc1e+BwT8YIbDMz+1d6x45U+VzODx6GBogdg:V2MrbDu+1d6xeU+c96oogdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637765533, "uuid": "7578a8ba-6cb0-4c55-b990-658659b0bf5b", "value": 69345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637765533, "uuid": "e00e1f59-df42-4172-a1f1-7b7f9f32edbb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765533, "uuid": "4b5530f8-8c59-4ee8-a235-0f0fa0355032", "value": "request477360122.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abdbf9b-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637782308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782308, "uuid": "0b2b8f68-8a6f-4c9e-9998-5c5d92ba788d", "comment": "Malware payload (Formbook)", "value": "8d9b2e32722363be0ad3c13cbdac1428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782308, "uuid": "f84977fc-26cb-4977-a958-9e2db9bd571d", "comment": "Malware payload (Formbook)", "value": "b42de5dea35e4771633b4063776640356f906a3f5dc3662f7d773209aef678a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782308, "uuid": "efa30d59-171b-4170-a160-c7fb57d94fe3", "comment": "Malware payload (Formbook)", "value": "602c7feafa7d28e7ba3eb05529c3be21248edf01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782308, "uuid": "e58cca78-84ca-446c-a460-8f55aab376fa", "comment": "Malware payload (Formbook)", "value": "a69eb2a416bca0db61b4e67d143c21472ce9a734f8d7e84c256b868859b4edc471760ea3b2df18075169ca0ca96db934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782308, "uuid": "34857c3b-3e06-46e9-90de-0c9baf8e11dd", "value": "T125541386D2C44C77EFD246300DB5DB3BDBB9B4940A99A0171F646F3FB8827DA491324A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782308, "uuid": "19416274-b5fd-4b68-b217-1fc9d4047de9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782308, "uuid": "d520ba55-ec4d-469d-a1df-c16d1ef6872c", "value": "6144:rGiRUJ8I4tlj8Rlj/z8YpjJgPogQr76Wtq591NjrlU0aGSdlOs:aJsSj/HjJgPoXZQbOGSj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782308, "uuid": "d9189207-bf58-4334-ad9e-53aa60697a36", "value": 303894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782308, "uuid": "2c76144d-4321-4c74-b840-75b21ace71e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782308, "uuid": "6ecbba83-d72f-4df3-878b-a178687f5b37", "value": "8d9b2e32722363be0ad3c13cbdac1428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6fb513-4d6a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637787945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787945, "uuid": "1154bc3c-b9fa-49a0-a4a5-f37557982afb", "comment": "Malware payload", "value": "c7157eeb8d5362d452dea1ba26b1b67c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787945, "uuid": "b8fc9e58-b1bc-426e-bf23-3e186e3a54bf", "comment": "Malware payload", "value": "b52af14eb676f40ba504c6c97cc06a75fc266a4abb3da6feb923701bbd8d0f51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787945, "uuid": "f91fa7ee-f546-4a6a-9e40-3ff49150640a", "comment": "Malware payload", "value": "be8b977fad9149cb1e04567daea3c5157dcade47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787945, "uuid": "c8724829-9cb9-4a5d-bfae-34fbee49f6bd", "comment": "Malware payload", "value": "664a19a29573b9acb0e402835e32222ac0e68dbac32a593f7da6ad60e708da333d2f4952a86a4f06cc4ebeceb8cede83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787945, "uuid": "ecc91daa-66d8-4557-9f2a-9c4ea99d6950", "value": "T19754222627D44E37CF0604B21C3BA77E9BB7A1E082116ED77F50ADBDF218992590A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787945, "uuid": "97372800-aba6-4e33-b714-88aa5d7d45c0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787945, "uuid": "847c439a-6abc-4047-87c0-5201f3ddd4ab", "value": "6144:rGiaAXCb429HwprhohVtThz/9VE8z9SLzAOVzF4sLoAqnVFxl:6b425wprWtVz/PEugAOxF4yohHxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637787945, "uuid": "9de987a4-546f-4e8e-8ed0-9b224daf3166", "value": 304199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637787945, "uuid": "3f552ce4-b657-44ad-9c8e-be48d5403c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787945, "uuid": "1877cc11-9f70-4d49-8ff9-dafc168e09b8", "value": "SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80642.18653.11801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b947d0-4d7b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637795164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637795164, "uuid": "2e6c7d2f-938b-4e29-a747-839d27868119", "comment": "Malware payload (RedLineStealer)", "value": "87f18546a47f06c4f3ed79df3e33a850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637795164, "uuid": "ae087932-d77b-4931-89ec-e592f0b750f4", "comment": "Malware payload (RedLineStealer)", "value": "b739c173ca7a74f745b3c5de3b90206afd04a9247ef3360b185b664dabb9e610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637795164, "uuid": "e7dd12ae-aef7-4c83-b108-9b8b583bf66d", "comment": "Malware payload (RedLineStealer)", "value": "952eea33bc77aa5806fc90dca685ee2db1b61c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637795164, "uuid": "e1827ddd-97cb-4c70-8095-457c7a9b2d25", "comment": "Malware payload (RedLineStealer)", "value": "2cf4f5b68909b28bf7ddfa54949ae11eddffb27f93f8606eb82ee0eca7e6c11f96fbcf0b6a2c41411941e278c93d8c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637795164, "uuid": "6367c880-aad7-42d7-99e8-6f757ee18d70", "value": "T140B4E03B21C28294D947277AC7A39F21BFB211D64723CBC9ABD8D5C08A851D57F09DAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637795164, "uuid": "09b4f5e0-56d5-40de-a409-f1127ebc30e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637795164, "uuid": "8488b10c-ee4b-4365-a7c3-a9db88dcd2ba", "value": "6144:1PWsWAQQ0imNPSVJb9hCXSc0e8YvwHBS1KvrJ6XjjoPRNMdP:4sWBQ0i8S5hre8owLJkjU8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637795164, "uuid": "5214a302-8ad5-45dc-8d51-58bfdbb977cd", "value": 529816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637795164, "uuid": "cfbd95fd-bdac-4b33-8c6a-6994bbeb65e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637795164, "uuid": "354ad9a7-c4f0-4974-99fa-cdcd003511df", "value": "87f18546a47f06c4f3ed79df3e33a850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5478228-4cf1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637736155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736155, "uuid": "704ed367-373d-47e5-83da-a9fde1ff68e0", "comment": "Malware payload (AgentTesla)", "value": "4cda59a30f07d7cc282a5e1796900e06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736155, "uuid": "fa4b9389-4639-4b1d-be43-986a8bd2ca34", "comment": "Malware payload (AgentTesla)", "value": "b7437d6a112a3376842df25812b4f38c48898b01c96c3c446b79316c2a14bd1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736155, "uuid": "5f7a96a0-e6f4-4a01-b0b8-b48ca9d45738", "comment": "Malware payload (AgentTesla)", "value": "ffd7c177bd0f29d7a7105d499cac94eb095c9a48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736155, "uuid": "19e27553-c536-4917-aa22-fc14103ee59e", "comment": "Malware payload (AgentTesla)", "value": "d9299c766cc41070345116992fe9e5b9268ec9fe04f951d59ec8005107a945624073d4a7106732c322c71a5906baa3cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736155, "uuid": "80268c53-8f62-4799-964c-ae4f8e4f9251", "value": "T1209423E0F6A430786217EF94A0997345F28D8D7EF4D20AA62F72A5011036BD7F7A5BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736155, "uuid": "98d8b65c-3375-4545-b75f-5046043ed463", "value": "12288:VUwfoNIINhV7ShaIsxrRKXR2HyuxjcjpcUbWAxy2b:NgNv37ShZsxrwh2HyCEp7px9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736155, "uuid": "ecbf45c6-5925-47bc-ab44-b7fe6525eddd", "value": 445151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736155, "uuid": "0b0dcefd-62b6-4ed9-a86f-3fb420e59679", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736155, "uuid": "f7e58069-8372-416c-a737-53fb4e3a6b78", "value": "bank details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755aa6ed-4d2b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637760958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760958, "uuid": "6eabc8f5-a036-4a9b-8b86-08b9f947f56c", "comment": "Malware payload (Heodo)", "value": "317fb9d7d45c6c2aa4ffade376732429", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760958, "uuid": "ca174d32-d506-44c5-88b5-ab4dedcdc71b", "comment": "Malware payload (Heodo)", "value": "b8ad4931315f781e7abb33bb193e0ea2419dd4e9302b3ae6c0471ff51c2fc8c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760958, "uuid": "80038c49-7cea-4f8d-8315-be619ab14faa", "comment": "Malware payload (Heodo)", "value": "91699c7c63541f8712192f32e78e00380b7f7935", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637760958, "uuid": "3234bb80-2ce2-40d3-b4c5-a093ec0d6975", "comment": "Malware payload (Heodo)", "value": "cf2a752e0d675a9f349e87591f9ce6771b099d53bc939b7f230f31d9df336c9cb940d0d5f445fec79aebc97438581862", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760958, "uuid": "39247900-dadd-485a-ba15-806ca7873f6f", "value": "T1EAA4CF11B6C29432E1BE05303978DB5608AD7D318FB4CAEBB7D82B2D4E741C19B35A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760958, "uuid": "a4824791-5dd6-4e4a-9258-1be458e3df14", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760958, "uuid": "648b7825-44fb-4e6a-ba95-37e6ed50ba48", "value": "12288:+AriSOG9c0jc5mDQxqfdR4iTQG8Ht3WZ6y1zTV3z1:vof4DQxMf4iTFUVWXpTVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637760958, "uuid": "388f8b6f-32b4-4fe2-8580-041ab9635ece", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637760958, "uuid": "d8584d75-052c-4c70-8aca-1f4cea642208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637760958, "uuid": "c31c4570-052c-438b-80b1-7d76239013c5", "value": "emotet_exe_e5_b8ad4931315f781e7abb33bb193e0ea2419dd4e9302b3ae6c0471ff51c2fc8c4_2021-11-24__133553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf876cf-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744461, "uuid": "ddbd1da2-a292-45aa-829d-7e472263ae46", "comment": "Malware payload", "value": "5f5c647f7c9e08073e2a575d328a5eea", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744461, "uuid": "2d857e3d-f7ab-4269-b7c4-52aca5549e35", "comment": "Malware payload", "value": "b9054159d1012b47d59020c8c3cf1e318327754fd435375fa6e41c259beb6f00", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744461, "uuid": "e2000e20-3690-49b4-83d4-e1bdd7c03e48", "comment": "Malware payload", "value": "fb4fe2034419fc439a63081ff5f8713eccc6dcbc", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744461, "uuid": "9d65fc46-9507-46e2-bd64-26191055a97b", "comment": "Malware payload", "value": "ab407b8a932be05f48ef271c590e04b8c291c7c03cc9d57a3dffd2d33fbd42575e3f83f39360db2395805bcf3ac3a8c0", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744461, "uuid": "0c23a29c-66d4-4ccb-b187-83d3421916ef", "value": "T1D3B5330C037ABCFDF95E42292B634EE1C1B9A1E1F5436192D26408A85D3F5BD13EF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744461, "uuid": "f1417623-4d43-45a6-ab21-4f68e351af4d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM7:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744461, "uuid": "65fe5ac1-7ad7-4f0a-911d-cb9db622f7e0", "value": 2416640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744461, "uuid": "6d5c500a-819a-4557-a4b7-bccdad9939f7", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744461, "uuid": "ed8eae36-bc7a-4022-b9fc-7012c64c1061", "value": "b9054159d1012b47d59020c8c3cf1e318327754fd435375fa6e41c259beb6f00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec89521-4d59-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637780597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780597, "uuid": "3e1e59aa-5cd2-42f3-92f4-daa3decce445", "comment": "Malware payload (Smoke Loader)", "value": "4c11583ce952a936c73ad17428805541", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780597, "uuid": "de5dcf89-7508-4e59-8002-38047a10a403", "comment": "Malware payload (Smoke Loader)", "value": "b996410101b932721193c3cbe614edfe760875dab9d0067e16220fcec55d32fb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780597, "uuid": "4c5369d4-e1f7-4a24-85d8-7c0f04804e61", "comment": "Malware payload (Smoke Loader)", "value": "71e83bdf5826fb869ff57b972b92ffbb45309cc5", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780597, "uuid": "27c7ccef-1add-4a8e-adc6-2f6c4006edea", "comment": "Malware payload (Smoke Loader)", "value": "40ff4008a37ec7f5a219c8354742d6d6f09cd6e5db5bbdc9ab808526d7e5306da55d9bfb7ba9f754dcf711b47056e311", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780597, "uuid": "c439032a-75eb-4e77-9918-8ee112e969f5", "value": "T1F3E3BE1073E0C075D1A7193068B6DBB12AFA7C325A7942BB37A8127F1F713D05AA536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780597, "uuid": "7b30bcbe-6c47-4ffb-9102-df7e37021f81", "value": "bf61ae69989d1072f08e18d6fa6b3469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780597, "uuid": "6c94baed-b80a-4eaa-8787-5dee090c3001", "value": "3072:q+oemgaoSit+07RkVzWIqvjE2qtR376Ivy2:T3aI+074bqc7d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780597, "uuid": "ef64ba38-93e7-4814-8308-59654269596b", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780597, "uuid": "0b310b0b-1eb9-424f-991e-e7461ef63689", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780597, "uuid": "2357b355-b37f-41b8-b446-a89e37ca7e57", "value": "4c11583ce952a936c73ad17428805541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a4d278-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774161, "uuid": "7ba4e99a-721a-4075-9c94-8569d8403c1d", "comment": "Malware payload (SnakeKeylogger)", "value": "2ded760998b86f504a8577f492e3bf69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774161, "uuid": "a772ab8c-8e29-402a-b0b2-5e6043298967", "comment": "Malware payload (SnakeKeylogger)", "value": "b9a46a921c30e3bad554976c0828dca15d20e06518515bc53b4f0422837d31e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774161, "uuid": "ee9ff664-01bb-4274-aafb-dd2fee696a16", "comment": "Malware payload (SnakeKeylogger)", "value": "0ed505d65fc3289890b1fd64d4353c205535f16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774161, "uuid": "87ad1317-b15f-4711-bd63-c787a4a30563", "comment": "Malware payload (SnakeKeylogger)", "value": "c42695f5d0dfb07d4a5a2dd578479f0c09a596c9b9b10c7f9cdf1f9c8540c162d833c16b2bc3590c09e169b0fc72beca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774161, "uuid": "bc6f18d4-413d-4039-89f9-7a7549be1c9b", "value": "T1F1A4591AA352AC40FA1CABF89B775FB11790FE72AD51D307E3787639943A3690984313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774161, "uuid": "b2206c1a-d852-40f5-a953-6764849c79e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774161, "uuid": "93933edf-5b1b-447a-b9ff-7daca84d407b", "value": "6144:nJ4al0wkmPncOf8DP97necd7AE55biv1oRk5W3ssFWq6C0Ri3QvNl8bZ5bKH5Jj:nJ4al05Ecrb97nec6MbivC22FeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774161, "uuid": "f85ec84e-a974-42ea-81a7-e6e9292ee394", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774161, "uuid": "e5211069-3df8-4a64-9963-730cbb4e1075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774161, "uuid": "52608790-1552-4012-be7a-3a2b6ef2ce3e", "value": "2ded760998b86f504a8577f492e3bf69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb068b23-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774497, "uuid": "3be29292-5232-4abc-a482-8e784276f1eb", "comment": "Malware payload (SnakeKeylogger)", "value": "4d58efae25b5bbf1b5d5fec09f547b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774497, "uuid": "f296eb32-c587-492c-bd25-23dc54580b55", "comment": "Malware payload (SnakeKeylogger)", "value": "bd4f9fc8f1e7bb8a31ad8c6320f37bcab772e0ec1a3471c3374dfdc62367f4a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774497, "uuid": "d0703653-7c60-4e01-97b3-14eb8b374120", "comment": "Malware payload (SnakeKeylogger)", "value": "7d9d686cdd86de37022ccbb8cccc6c1a2b0b1d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774497, "uuid": "65eae00c-04e9-4bbf-85b3-bddf0f744fae", "comment": "Malware payload (SnakeKeylogger)", "value": "c5650b797851ed52e7de175dc742802610a544e0d6addf259aa060758021c7b8e9c313295e5b0496f9680433f32c9c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774497, "uuid": "8d20a23c-f9ab-4a84-a341-b5941f148bcc", "value": "T1B6C3175C3BF88804E6FF8A3311719121C7B6F842195ACD1C1AD1F55A2EBDA818D1AFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774497, "uuid": "4a96e1bd-85be-4021-8dae-fafa2b35b766", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774497, "uuid": "60fe9258-3975-4ba0-ad7a-e18c491f5e64", "value": "3072:S1UEXpgJkbCq2qkuzLWJfc0Z7bC0czYwB1HnbY:2fLZk/fcybMHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774497, "uuid": "35d2f226-f438-45b0-9d8a-bbb4e649f93d", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774497, "uuid": "fe68f6dc-d79c-4b06-a12d-36490b07f8b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774497, "uuid": "1fc0722a-b35d-4028-973c-355e4dbd463c", "value": "4d58efae25b5bbf1b5d5fec09f547b8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afe6eca-4cbc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637713267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637713267, "uuid": "37b2f85e-cc1c-4ecc-bed9-2609165217db", "comment": "Malware payload", "value": "f77b7e551d1b31ea4eadfd747ef74b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637713267, "uuid": "f6c66136-cbfe-4b7c-8679-c3780f3a41f3", "comment": "Malware payload", "value": "bdd4a86b2edf5a0394af6054aa0235be1e970d7ae21e4615c94f5167fdec7419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637713267, "uuid": "6db00e3e-54a4-4550-8f2b-4204bb170ba7", "comment": "Malware payload", "value": "249a7f2951a7f1164a0265a42f0dd60df24dc2f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637713267, "uuid": "6afd6a81-a716-4254-9a64-9283cf3c3f2c", "comment": "Malware payload", "value": "6a20fd02af407304eb3eb94b67cb3595f0b718225d44da36a50be82c4102dc7b62d52c4c1533408c127f52544a023f47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637713267, "uuid": "4c64104b-4c7a-42ab-af16-71000a733533", "value": "T14E0622D1EC66701DCDAAFA35148ECA3C90BDEC20C6C452A16F6E375F9DD6F9C9620086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637713267, "uuid": "877d1a55-4a30-4bae-920a-1fcb381eaec4", "value": "66ca40ddd484286266f124230bec8b21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637713267, "uuid": "7c111257-140f-4575-8aa9-f2d2c430f114", "value": "98304:+Jwg48hJp9/wkOs71vXcwn8GzAYmLQQaCGk2uUglR:Zg48HVOWcw+YmLvXFOIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637713267, "uuid": "41942adc-3d5e-4a55-9965-0344165ba603", "value": 3838428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637713267, "uuid": "b6645411-15d3-4ee4-8035-d4e0d6239cd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637713267, "uuid": "321b0be0-86d8-4f2a-a9da-a80d231ed77d", "value": "JITStarter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322a14eb-4d33-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637764282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764282, "uuid": "4ed18695-f92b-40e9-a695-a1595ea7e72d", "comment": "Malware payload (Formbook)", "value": "82a1386c25393c9d6f2867a8094f81c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764282, "uuid": "3e39a1e8-3ac2-452c-82a0-cb9575c53cd5", "comment": "Malware payload (Formbook)", "value": "bddd097c283b04fe3f26e44f1640b5496d8d29251fbf41c15c179285919eb3b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764282, "uuid": "09f4e0b3-458e-4bfa-b86f-0213612daf82", "comment": "Malware payload (Formbook)", "value": "4326a3af2f97627611acca475105e7f2dffcc222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764282, "uuid": "1b555e6f-c824-4a62-aa3d-931618a9c61c", "comment": "Malware payload (Formbook)", "value": "61eab25fce546d345f6370f847d7dce5dac64684a98c799bc6d45db8d4e90ff4e5fcc2a70fde23e89c66fe235bb7308e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764282, "uuid": "a58aa984-7850-40bf-a006-34fa59fbc686", "value": "T17AF45933EEED9E2EE86E0D77C41C50A896FFED001914A139FD5BF2BA173164446381A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764282, "uuid": "22034ed1-4c31-4f7d-9424-5255ed696918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764282, "uuid": "5b3b5c15-712d-43cb-acd5-fbc21e2f8944", "value": "6144:RBameN0GJdkNkPp7xZdk5W4cT8ijrZJLwHqhgB/YT4oifdV5+VSbcVmPOtTpmfxp:RhePBPD3+5CbrjLwKKOoV+V7VmPOfmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764282, "uuid": "ca5346f4-7cf3-4d8f-a48d-9db020bc275d", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764282, "uuid": "1e5b2cb9-471f-44f8-9739-3186c41d7c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764282, "uuid": "da2eaf29-ee85-44ed-b5d4-7753440a4d19", "value": "S.K_TRADING-RFQ2021112484JP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaefcc00-4d24-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1637758149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758149, "uuid": "9e5d560c-8e89-415e-8f84-3e380822fa64", "comment": "Malware payload (SilentBuilder)", "value": "81b1effc5fbccbd14a6b2140b4b22ef5", "object_relation": "md5", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758149, "uuid": "766dbe54-9828-4832-bff3-c713347fae40", "comment": "Malware payload (SilentBuilder)", "value": "be3a73c3be842e4d625ffea18724c5765aa4dae68070b1ed88945297965b229a", "object_relation": "sha256", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758149, "uuid": "6de9216d-23aa-4cbd-b570-2b5548955cd9", "comment": "Malware payload (SilentBuilder)", "value": "b75ed9b2e096cf1fd5e21cf6cc57d1303aeb03bd", "object_relation": "sha1", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637758149, "uuid": "3e1424c6-62c9-42db-b478-fa595fe79bdf", "comment": "Malware payload (SilentBuilder)", "value": "e8a098a4860e9e787b6159b94af616996c85a1cf1200e1cc890f4690140742dfbfcccb57da50c1f99a53410116ab2af2", "object_relation": "sha3-384", "Tag": [ { "name": "contemporary", "colour": "#E4681E", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758149, "uuid": "ab33d62e-ab90-497a-95de-bfc3f7814d8f", "value": "T1FE34E146796CC8DEFA57833148D75BAA6333DC204FD71A876AC9722C6FB4DB47912006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758149, "uuid": "be609d0b-88c6-48e3-96e1-23b7a53e06e6", "value": "6144:MKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgwcfFw6lxFT7kFWqOSMQ6HujLmH98DU/:tFrlxFTMrvbiFd8D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637758149, "uuid": "eea34a62-3ac5-43e8-9f8e-e3aa2773d6bb", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637758149, "uuid": "43f347de-24d4-414f-8c11-fa61b97acd53", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637758149, "uuid": "24ed702c-2bbe-4aea-ae2d-c4158d25b534", "value": "private-1915056036.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a698189c-4d3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637768343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768343, "uuid": "373d3697-51f0-4ab4-a2d4-828ce05d760b", "comment": "Malware payload (Heodo)", "value": "56547488fb182b73f83211903ce2dd30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768343, "uuid": "38e8f2ec-4832-46d3-a36d-e3bf527cc312", "comment": "Malware payload (Heodo)", "value": "bf0cadbc8a6b28a54eb0db5f2afe582a02d5f1dedb058097abc1d7b43ba7deb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768343, "uuid": "21a5cf19-b5ab-4093-8210-d6652a42386e", "comment": "Malware payload (Heodo)", "value": "e3c962932fb99e7685ea989356d60afc4045c52f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768343, "uuid": "7ed35986-8e99-4239-90f6-ff4ea6850177", "comment": "Malware payload (Heodo)", "value": "346637f73ea5c5dd3d20095b1b1fc882bf9d0f88edc771c13e1b669bccd92a6756cbfcea795c0daf64accbd20671127a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768343, "uuid": "942e9d86-62df-40ff-8e68-a460ddfba5e4", "value": "T183949D1325EDBDE2D5B9173037BBC7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768343, "uuid": "fca50b20-43ec-4e81-953c-58c843cc1355", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768343, "uuid": "7c722acf-9f5c-49ce-8606-52b0d35214a5", "value": "6144:1ACzUEcRRKxe0DUAldEzpLcE0sepO8+wM:1lxemHQtcE0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768343, "uuid": "44cbd757-18db-4a76-83ee-ce444077611b", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768343, "uuid": "c3e4ad90-ea86-4487-92e9-e514b712f3b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768343, "uuid": "0906ee7d-b78d-40c4-89cd-8dd505c0686e", "value": "56547488fb182b73f83211903ce2dd30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc39cf82-4d2d-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637761990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761990, "uuid": "72554dc7-83e8-4273-8b59-950dd5cba40b", "comment": "Malware payload (GuLoader)", "value": "ff71941571d8930c1125b3931d400d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761990, "uuid": "66a6a4b6-e1f9-41bc-b6c8-23485b3df25a", "comment": "Malware payload (GuLoader)", "value": "bf952f1cd44de7bf63c63e502670d3a6a97eca1b5f7fd9981ed0d235351e975f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761990, "uuid": "1749f22c-182e-4189-9461-82e725ba9e5d", "comment": "Malware payload (GuLoader)", "value": "0a417bf568a5978777021e433bf4693893facd3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761990, "uuid": "ba2732d4-2563-4824-bd09-cec35939d541", "comment": "Malware payload (GuLoader)", "value": "ed17807b080161ded0505708f76187c1ee4b81b1c8e96c6c5d89fcf7ba0735298c50f3241648e7ac0a7aec11c37fcc09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761990, "uuid": "7c9c4f76-149a-4dcf-84a7-c6e4c47e5020", "value": "T13A244BBA8B1C9813EF67A871241DFF511CC45900E64806FFB456FE9D2732A623868FC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761990, "uuid": "85a3d4be-b9e4-433c-85c0-cc8ae1012f87", "value": "0866620dbb47fce5dcf62fd73a28087e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761990, "uuid": "0465d2fb-924f-4755-bec0-0a4cb65dfebf", "value": "1536:uZVG0Dx+5ddSVTrCH+Gbe99P0ezrHSjetlvrrs2gb16A7OsJ4AdDuZxnRVxekC3S:4G12TrQ4zOC5g7OK4AdD4re3RVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637761990, "uuid": "3f791c83-0675-4c9c-aeea-9deb4939b583", "value": 214328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637761990, "uuid": "7ac80e81-590d-44c2-8967-5972c4e914d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761990, "uuid": "b8425505-52f5-41f1-b4b6-a8cd808357b1", "value": "Arrival Notice, CIA Awb Inv Form.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597752a0-4cfe-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637741584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637741584, "uuid": "488007c4-cc7c-4921-a732-29db1c553faa", "comment": "Malware payload (SnakeKeylogger)", "value": "dfbb50ace2d4f912236edf262cec920f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637741584, "uuid": "8292dafd-1f0d-4990-971e-fedcc58e26b2", "comment": "Malware payload (SnakeKeylogger)", "value": "bf98c720f632aa3f1e9d3016c094e7784810208aa99adddd42f9b0ceae6b627f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637741584, "uuid": "8c6aec4a-86df-4f26-82eb-6b94dc614e48", "comment": "Malware payload (SnakeKeylogger)", "value": "2c58e4451668ff8ee04590ed7e2d17d00ef29b2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637741584, "uuid": "5a3ef1f7-45b2-4a37-bf7a-84e08b7a8ac4", "comment": "Malware payload (SnakeKeylogger)", "value": "5acf44e440cffa7080b81537465c1bcae71a6ff5308c3da9c518a1acc277bf0b429cf0cd7cced567699f8e95be849fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637741584, "uuid": "d8ed4746-d404-4667-aa96-33c6ba9a760e", "value": "T167C4E03B9E6C1637C3B9C67657DE450FB2B049533228FC8DA9CA4341D741A82A5C7E2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637741584, "uuid": "02c0eb14-3c6a-4c13-b18b-0785ab645e22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637741584, "uuid": "d12d957e-8c1d-46a8-a80a-ad6223e1d8cb", "value": "6144:Qx5ZR/gsojaue4VIESQXeGYTizUC6iHIC3RIsra9IRBNJSnYtNCUbGc13qJHbCrP:Qx5ZR/v0Fe4VIbHTL+o6nO9IzDDbQbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637741584, "uuid": "327c2b45-f044-4685-8eeb-b8fce98f840b", "value": 566200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637741584, "uuid": "5e33ae35-cc9c-444a-8f52-f3065645198f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637741584, "uuid": "f797b2db-1405-4ff8-b660-7ebd09b6b557", "value": "MT103 Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6273a702-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637778966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778966, "uuid": "02cebc0c-ecc8-4914-8813-8a72eb3ed9f4", "comment": "Malware payload (Formbook)", "value": "940eae024286cf647f35ec5f8e7e36a2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778966, "uuid": "ce572fe5-10fa-4d20-b145-b7b480c21812", "comment": "Malware payload (Formbook)", "value": "bfd45290f3080da5b5810624d5dd8b24bc6c95731201740545be2b440941344e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778966, "uuid": "c06e21b6-83d0-454d-a0f9-136e5da522bf", "comment": "Malware payload (Formbook)", "value": "1e77269b09bea8bf24578c73e0a35219588f9d57", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778966, "uuid": "733f0f19-ab80-479e-bc1b-d79e28f554d5", "comment": "Malware payload (Formbook)", "value": "4f8ee08e6423ea937f1b263c618b796254acc26bc3c5c4264703ffac88d0b54ee502d5e613bcdb757ea3273c0de9b545", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778966, "uuid": "7545e024-93ee-41ed-9b8d-45ba462bbfd8", "value": "T11AC40251339CAB93CC355BF11D7280C423B271167950DA2EACDA72CE6D32B590B16BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778966, "uuid": "998efe38-7e93-426f-a6d8-8f3bf0c58da3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778966, "uuid": "fc1586f7-b371-4d89-8fc2-37f2ea734b0d", "value": "12288:AItD00cpVDsYYrE0KxDm+po7VWApbhqw6XXOEOHvq:rC0c6YY40Oppo7Vjx6XmHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778966, "uuid": "ba208385-9531-414f-aa56-b267e67ec296", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778966, "uuid": "fd3d5d36-5b31-4df4-9e22-2b9c7c4330fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778966, "uuid": "bc09d482-ea98-427f-8556-4eefbce23f8d", "value": "DHL_AWB_DOCUMENT___pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcab95e-4d4d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637775740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775740, "uuid": "e4a5dda3-2530-49ae-ba32-953194166fbc", "comment": "Malware payload", "value": "8907ff3e3567ead8af8b5612f30577ce", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775740, "uuid": "0ae0be3b-97ba-4124-843b-29eec9672c04", "comment": "Malware payload", "value": "c0173cfaf459e1e8971d5cc6d85f257c96bc3c9a38022afb862d132fea21ae6f", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775740, "uuid": "547c6655-4c58-44bc-a0c0-cc8e8ec54853", "comment": "Malware payload", "value": "57929e55fa4b8cee0c49d3dd0a4ae268484a0a7b", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775740, "uuid": "663c826f-f478-4f2b-977f-2d4e58b3163a", "comment": "Malware payload", "value": "23fff41aebff1b34317168c7c301389c87e0b88beb1da395674fbde9e33657182fe7a0524d0ab2ba3c86c7a893988f79", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775740, "uuid": "31ee44f1-fe29-4219-b641-92a26479085c", "value": "T10B02BEA354C6518EEA5E0378BF9517374B26A0253F947A47806E32FA4B06CC13E57ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775740, "uuid": "a1f889d3-46e6-42d3-967f-6ff06cdb01ae", "value": "96:nSxNP1wqupqtWrc69CNgdFbYbV9J2cEG6d0aWKto8bOV/gYDZ1gNUEZJm2kX8lbx:nCP9tWgKCa7bSPb6pWKmQi/gmnkdQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775740, "uuid": "759e8b01-db52-48eb-aa58-3d779e6fa080", "value": 8560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775740, "uuid": "b8e82897-34d5-4d28-b576-0ed3675f2863", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775740, "uuid": "7c0a667f-f139-4711-89b8-87012f882a4d", "value": "Order Contract_signed (4NQ39NGAY0GD).ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46461b9-4cbf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637714759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637714759, "uuid": "d5457106-92e3-44fe-b933-5524b65e2bfb", "comment": "Malware payload", "value": "7885b4f3b89c57a29b5562be8d9ce31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637714759, "uuid": "4352c135-f237-4ed5-8f64-d208355d5d8e", "comment": "Malware payload", "value": "c04eb71df59e5a3456442732f934a06b0de872cd5a4d94ce5617bdbc7ad093c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637714759, "uuid": "f056e5fe-7ccb-4785-8c63-0c7c37bbec13", "comment": "Malware payload", "value": "08fd15fd744799d9f58438d5192052e96b923749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637714759, "uuid": "d346ccd0-40ee-432d-8ade-42a95f0b73f3", "comment": "Malware payload", "value": "a663db325c3b9f0d2474d51f7045749e5595096d5434d52f8696e14d186c70e8d0ab731edefd704fe2d4bd10b1f4f5a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637714759, "uuid": "06b1267b-1c08-4fd4-a0d3-abc7321da54f", "value": "T1EA44DF1B67A01CBBD17B86BD8997490AD77638210361DEEF03A4429A2F237D15D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637714759, "uuid": "e82f1d80-bc33-48fd-869d-69f60112a85f", "value": "b01abbf9bba0f1daf3b4d5629e6a666e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637714759, "uuid": "1165a4ce-f6b7-41d8-8038-3002e5df903e", "value": "6144:14k0pfZQiKLYKCoYpM7J+M/hg2gS0pSeQV:1xUeYKPJ+M/hgAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637714759, "uuid": "c30625ad-2aa2-400c-9816-bb453d57ad72", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637714759, "uuid": "46c09e1f-4c7c-4123-b6ee-6a33890149cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637714759, "uuid": "623077e2-ec4b-41ad-ac20-25ae6409266d", "value": "c04eb71df59e5a3456442732f934a06b0de872cd5a4d94ce5617bdbc7ad093c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30cec02-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637772766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772766, "uuid": "239f15ab-3ff5-4bc2-a5eb-a08ff95867eb", "comment": "Malware payload (AsyncRAT)", "value": "f9c0d1c69dbd21d9b47b0d1ff06bee43", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772766, "uuid": "406608db-a04c-4000-b9b2-68093bf627a0", "comment": "Malware payload (AsyncRAT)", "value": "c054d576bd0cbb6dde7a140a82f1f50dd0302b8f303c038ecb2f2e491f62e114", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772766, "uuid": "d4e861a4-2591-4260-b020-4974a835f793", "comment": "Malware payload (AsyncRAT)", "value": "1906ad43ca783cf96fd823169bb80c1098e975a0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772766, "uuid": "1aea0ba2-170d-401f-870e-9b45c11d4e51", "comment": "Malware payload (AsyncRAT)", "value": "574db0cce288e57896bc30ecc381a4a5e926435316c4f5c5856c83db182148abefc08f45110dc5cd97db6229db1c15b6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772766, "uuid": "7a451b82-7ed8-47e8-9b70-cc1c6cc4855c", "value": "T107E4F17A2AE3570A48C9CD339BF6FE8C08D5A116F7DEA9B0326C99C055444C17ACB58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772766, "uuid": "e00b3292-849d-4703-b863-3cd791d6d475", "value": "12288:nELFztSTkg4Lag9IU0YuYx5jQtonyBehPWtCOoMUndyXIF:niPSwBmguU0YuYxxKoGehPtMUMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772766, "uuid": "aaf9d485-e00a-4c9d-a980-defee0d4bc06", "value": 713483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772766, "uuid": "66f2d390-b8e8-43c2-a400-a39440670ca5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772766, "uuid": "14fd8242-0645-4963-9ad3-5a4db2fd5f44", "value": "PO Approved.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fa425a-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637736592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736592, "uuid": "411d527e-d83e-4c3a-82ae-e49bc83f85d6", "comment": "Malware payload (Mirai)", "value": "6f40201e392d696fe9caad87c8d08c7c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736592, "uuid": "9fdb6916-7a21-46d8-9a38-86297b555701", "comment": "Malware payload (Mirai)", "value": "c0db76a6c48ed62f9c04a74fa38f5dbf8aa9e4fa4904a5fcd26f1cec6a3ad90c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736592, "uuid": "0fd022dc-2d6d-49de-8be9-dec13348c0ad", "comment": "Malware payload (Mirai)", "value": "af98addb94a0f2826a8b7bffddf3c07e7d966f16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736592, "uuid": "b00f86ac-c3ce-475b-aadf-cfdd93037d9d", "comment": "Malware payload (Mirai)", "value": "ee5b32451554f15a907f782a9c13e87061d3b8a482394339e9563187cf4c6d8abcb6fbc5c07a011aa01bb7bed5f8d200", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736592, "uuid": "4b3030cc-7c78-481c-a4fe-1cf97c8e1ac7", "value": "T132832986BD82AE16C6C5037BFB4E438D33226398D3ED7213DD156F1177CA92B0A6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736592, "uuid": "2f234da2-ea4e-40e7-bda9-9268b00c7f7f", "value": "1536:4XRlXSSAKJvoTtGsM9lnEbSyn93zQ6LhRgFz6GxWw6j3O8DABP4TwbZnO9:4SSL3s0leSizQ6LweWWw6TDTwbZnO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736592, "uuid": "f45c5336-0270-49c3-b1a6-aad9aec45b99", "value": 81452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736592, "uuid": "a005656b-7657-437a-9822-32532073a4ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736592, "uuid": "1b14af94-5e63-41bc-a272-afb5c15fafc9", "value": "arm5-20211124-0649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647d29b5-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1637774245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774245, "uuid": "376b4302-379c-4683-afa4-c1a6b7a54132", "comment": "Malware payload (Gozi)", "value": "76a29095e02a151adc1f42ec844a65bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774245, "uuid": "8f1d559a-8efe-4017-8720-e5f737537045", "comment": "Malware payload (Gozi)", "value": "c26838865c476704101363c16c535dfae494dedadae972c0377c4f67669578b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774245, "uuid": "abe02e3c-6090-44f9-b16d-1086faac1f2d", "comment": "Malware payload (Gozi)", "value": "afd4593a0e709a11296556d5b1fb1833bb394c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774245, "uuid": "cec53a7d-3b5e-4086-ab7c-187ba7332a9b", "comment": "Malware payload (Gozi)", "value": "2aa6d6bb8f6d8b245f45a7ff4a4e71d38c7419575e34215dff02aaea937f654d25f6ac0feb368c53b7a6622ea818f26b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774245, "uuid": "36b19bae-4697-40a1-9201-ef7e601fcda6", "value": "T13D54AF007BA0C435F5B716F889B9D3696A3FBDE16B3890CB52D426EA56396D0DC3070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774245, "uuid": "a16503a7-13be-4f8d-a48f-3bd9c483735c", "value": "227bb68f00c01d84de5b7cf57cce44af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774245, "uuid": "665ad4fc-a418-4864-bce1-6d4e18d7c542", "value": "6144:mOcPU517+45GlCVKk8PVSXuZet0yyeuI3+9jbUm6nzKvPV:mOckd+RlqKkuVSXuZet0yyeroHUm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774245, "uuid": "26f21813-1b0d-4751-9904-b77cecb0aab2", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774245, "uuid": "51ffc865-701d-4ce9-8c67-85bbcc4f1c48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774245, "uuid": "da874817-d99c-4933-917c-766b69f856e8", "value": "76a29095e02a151adc1f42ec844a65bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45418b90-4cf9-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637739403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739403, "uuid": "c6f7aa40-42a9-4afb-8379-416237cbd94c", "comment": "Malware payload (NanoCore)", "value": "e8ae42cfaafd650a14285aaf700d1f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739403, "uuid": "d4d5168c-1ecb-4489-b9b2-ff5b09c307f6", "comment": "Malware payload (NanoCore)", "value": "c398ec8923c9de2fe4ff2b9804f41663b1e929b22b3ee848576014f89663618a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739403, "uuid": "ad3251ac-9071-47e4-b049-6f62393b2887", "comment": "Malware payload (NanoCore)", "value": "d4da7fb39e1ef6aa56b01173ebb48fbd80acb416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637739403, "uuid": "fae8a898-aa35-44d7-ac61-02346f46bb6c", "comment": "Malware payload (NanoCore)", "value": "884e620753eecc483de762a0b7a5aaf7c5f431d6a4935b7097bad0e1d87716fbbb0018f589cb233f6d4a6e228a639058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739403, "uuid": "43152ab5-2acb-4ba8-89f5-faf76067d5e4", "value": "T1ACD47DD0E5BF98CFC08A477A6867BF2815AD6788C875871E151FA71D94A3382300BDDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739403, "uuid": "8063f4f3-03f5-42da-853c-a8d50e270376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739403, "uuid": "e150828d-09fe-49cc-a6fb-2341a1b2a326", "value": "12288:CBC1JfxsMZulg8mcbX9ON+iKFLfRcEvFU/vuRPAaQ:fxsMI2HN+LDGAFOuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637739403, "uuid": "3ab3a3ee-970a-4f26-b55e-dafe8ffe17ff", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637739403, "uuid": "ff9b58fe-ddb0-4140-a440-60c720871470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637739403, "uuid": "f362a872-24eb-4968-8558-9db5a90726d9", "value": "e8ae42cfaafd650a14285aaf700d1f2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fc3348-4cfb-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1637740532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740532, "uuid": "80c5113a-70a0-4c65-86ca-6ce020b54973", "comment": "Malware payload (AZORult)", "value": "f88740451956d87424b84326e9e9dde7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740532, "uuid": "d868dccf-0813-4915-b3dc-c850e79b004c", "comment": "Malware payload (AZORult)", "value": "c594188774a2d72b774aca96eb096c493dbe5c9b599bef4601ed404dfe2fab53", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740532, "uuid": "2b765cd3-5410-44c1-804d-1c75113bd95c", "comment": "Malware payload (AZORult)", "value": "a0ccae106a243ad2b1d748512c3e6783b2dd2547", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740532, "uuid": "6b6f59f0-46b5-44bd-bd8d-9438c5359287", "comment": "Malware payload (AZORult)", "value": "b2901d495599f71f43c9038f68314b9429832596c835055406697263c5730160f5bfc91f8b132fa2f5cab4fb6cddf0d9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740532, "uuid": "3260d1e9-29e1-4fd8-8dab-5aa08262f107", "value": "T161A35D4F6E201159C4363FF95A7A1065DAB480178F480C57F35C7A299F6EBE9CE202AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740532, "uuid": "acc6115e-c783-4711-b7f9-a1ea1b415c50", "value": "06ac1f21ee2a357ffb0dd7db52cbbb13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740532, "uuid": "41e67d5a-05ac-4a1e-ac5f-750c0b42d0e3", "value": "1536:IuW0xpn7JWWkH7Jx1Q3jh1GTuGi1GfT4i1GtszSGkckZptXUG8IUcGHPGq9OR:G0TIVAncytktIJGHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740532, "uuid": "23e5ac8c-88eb-4a3c-9678-10a442f7bcee", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740532, "uuid": "1e9689fd-699c-49f5-988c-ba70d59e8bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740532, "uuid": "8da80dd2-89c1-4219-985e-383e1f4fd4aa", "value": "C594188774A2D72B774ACA96EB096C493DBE5C9B599BE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840cfb9e-4cc7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637718033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718033, "uuid": "c007c9a7-73da-4cb5-8b76-5f8d148296d1", "comment": "Malware payload (RedLineStealer)", "value": "7ae5c3474bf5d68923c4e9dc1d8f3582", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718033, "uuid": "131bd999-bbca-4fb3-a0b1-696cf3bc6258", "comment": "Malware payload (RedLineStealer)", "value": "c673b3761e62950bc50a90616336bb86b4710e38e0d73dc76a4feb9a488e7e90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718033, "uuid": "cee3edbe-5c9f-4ea3-9f97-42bd4167e4ea", "comment": "Malware payload (RedLineStealer)", "value": "2d1a55a495178a33ea00a83078e3b42ffa9ae37e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637718033, "uuid": "c8f90687-a645-4194-8c13-5a88320d3c91", "comment": "Malware payload (RedLineStealer)", "value": "a279b7f3c2222878e25362f2c9a142d5dccd157e0bab064e740077f1f486984915d5c6267343e8f982e2ea23ccc9a1da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718033, "uuid": "9fb6c995-23bc-4147-a2ee-7ba832f95863", "value": "T1DBA4301F73C2C212C94767F6C6A3ABC1BBF110D5432B57C8AB0E85E08F991692F55EA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718033, "uuid": "47feed60-59d4-4f7b-8f9b-bbaaf01f6535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718033, "uuid": "1409f7d1-a48b-4fc3-99b4-fa93f68535b1", "value": "6144:uolr0vRz10a7k+K3qzF6iK7573UisG/KLOzUH3I3IPfx2:uolgwarKG7isC6IqZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637718033, "uuid": "e37c93af-befc-45d9-8245-266b6a387ed5", "value": 459672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637718033, "uuid": "8da434da-7366-449e-972d-ec7375c4533b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637718033, "uuid": "b03e6221-170d-4d2f-ba88-5bdb72e6aff5", "value": "7ae5c3474bf5d68923c4e9dc1d8f3582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841dcedb-4d03-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637743803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743803, "uuid": "91e6991a-fbf8-400e-854e-d4f1e8f36517", "comment": "Malware payload (Mirai)", "value": "743942c960933dbfb1e2ca7c5af9f57f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743803, "uuid": "47fd0964-9fc8-4af5-bcdc-763a013bd8e8", "comment": "Malware payload (Mirai)", "value": "c6dcbb034bcf5fd1002e393a85d699e9b91a840da9dcdaa25f7b64b2eb4343e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743803, "uuid": "76ae61cf-4747-4707-a178-124114d2a481", "comment": "Malware payload (Mirai)", "value": "47dfdd081c91ab27dbb8d09b4628805362568597", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743803, "uuid": "09124795-e524-43f8-a81e-243d7e10ef15", "comment": "Malware payload (Mirai)", "value": "0da49e418665d5182641d5492fa36eabd06eeeaa35e6c5dcfa5855bf5d8f01b296cdb8fc4ff825c6ab9125d75f26a095", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743803, "uuid": "213c2a3a-5168-4d79-9480-24fb7af0c0b6", "value": "T114A35C86E283F2F1EC050D347067A772CA7BD67A7139EDC7E398DA3A9861202C511A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743803, "uuid": "0637f535-01f4-449c-9537-1b0167d05f24", "value": "3072:O/S1ViF7uwBCel/UCHsGdPR38Od3aV6AzY:OK1Q7AvSqYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743803, "uuid": "534e7961-9bef-408f-8f33-9fda63e3d818", "value": 103664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743803, "uuid": "4dc34d51-0813-452f-a52c-da72027e68c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743803, "uuid": "1bb50407-c91f-4058-964f-b1e518a747c4", "value": "c0az1l4js3001lsk4xd9n.x86-20211124-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a62c82-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637779156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779156, "uuid": "4b1826a2-8d16-460b-94ac-51320623d8ec", "comment": "Malware payload", "value": "4e1ff7602a2be9a064e06b9b82bdf925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779156, "uuid": "1b029761-692d-4361-9ac4-102d945b762c", "comment": "Malware payload", "value": "c7c7340ed8095b5062985be9acbd38af8630d8ee8d7fd97563c0226962a935c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779156, "uuid": "291e1948-6fb3-4857-b280-a6e05b6fc27e", "comment": "Malware payload", "value": "4e60dc7cb74c1e407ab47bfe2d644861f53e6a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779156, "uuid": "195964c8-043e-4a51-9723-0ac9c4482134", "comment": "Malware payload", "value": "4a61009d3ae684eb725475f3c4c1d07c0b82853ec95426c028b32da81f1fcaf4aabcaae262d7f3dc50608c4dec947b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779156, "uuid": "f3a209b8-9b30-4f0d-8947-0355cc96aecd", "value": "T14E24C7BD348AED83C82A4F6D00456024812764DB169BF39275F919CB4FEEBE46A417CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779156, "uuid": "dcd5455d-b651-49db-b2be-44b8c8f63281", "value": "3072:qIFmmKN5pX05adwB++j317gttjtdx/atT38ymCp7swOUERxPOuSupbW8EFlas5kN:1mX5pE4mR1UztXi08s1jhhpKojIotd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779156, "uuid": "d5c7c15d-1c1f-4cc0-befe-ee20ea3bbdd8", "value": 222651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779156, "uuid": "8ea19246-2c65-4f45-8b0c-8e44dbbc5ace", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779156, "uuid": "38b39516-1103-4864-9aaa-b5e814080cc2", "value": "4e1ff7602a2be9a064e06b9b82bdf925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97119535-4d2d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637761874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761874, "uuid": "c72d3e77-550c-464a-8c71-e254e9f0fe9f", "comment": "Malware payload", "value": "954337d5104685d5c829887b7d4b7558", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761874, "uuid": "3b36dcf6-4ce6-458a-8c6c-a96ded192c44", "comment": "Malware payload", "value": "c88f4498de0cdcd8afb9a1066bc3d849751f38da1c56b0852ebfd4b9598515f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761874, "uuid": "1ebb5fe5-b798-4612-8cec-99db4cce0724", "comment": "Malware payload", "value": "42261da0b19309f03837068c5f13b00731110d1e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761874, "uuid": "8595f65d-8f6e-42d5-b5bf-198093f94222", "comment": "Malware payload", "value": "cc4753a3065647ffa6153ab98210670e1fae471e1cfbe35e4cc0e636af872e03a594332f407758e0b512585ce6bcb2e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761874, "uuid": "40ee8c39-fba5-4705-812b-7249a49dd2e6", "value": "T18015D02C8B5C16F2C5A2E8F4CDE45C97BA18AAA41158E809824F21459CD02FFFF4DF4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761874, "uuid": "a5313bce-0bbd-463f-aa63-fce23043ea27", "value": "7fff478ace3b998260914d7dd0fcb253", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761874, "uuid": "d48f043b-5637-46fb-8fb5-7d8bce338919", "value": "12288:U6Z2uLgXGbWIN3lqDC1WEqmCi5vRZdra:URsgXVa3ACEldi5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637761874, "uuid": "7a099614-d57f-4632-b56d-bce3f033f392", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637761874, "uuid": "4f1814f3-7bef-4734-b30e-945032d2a779", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761874, "uuid": "a225bf76-f252-41f4-ad3a-20a9ca318814", "value": "42261da0b19309f03837068c5f13b00731110d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe385e3-4cff-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637742105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742105, "uuid": "0132a093-82b9-4a55-9d8d-8a3db494b6d0", "comment": "Malware payload (Gafgyt)", "value": "abfb5c33b26d5737f2b3abdf934ae414", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742105, "uuid": "ef37b09a-e01a-4550-a7d9-b3f67144a93f", "comment": "Malware payload (Gafgyt)", "value": "cac308db042ca27f8f24655e28860684d1ca944dc7b69035c5e5b62f92c40f8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742105, "uuid": "61d6beba-212f-4202-91c2-228a4d23deab", "comment": "Malware payload (Gafgyt)", "value": "3520961792c41e765c82b766b2c00273f2a70ea6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742105, "uuid": "80f5f216-c91d-41a6-8711-0a89f2983771", "comment": "Malware payload (Gafgyt)", "value": "55ddd5f755465cfcacc9e228cdef1afb7cb349df5ad0ec98c87a759609ba50c4f9f997c83edeb93cdd9dc4902cafd945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742105, "uuid": "f002a81b-7e65-498f-8f84-f80b829c5f26", "value": "T17A934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742105, "uuid": "93541594-1147-4a9c-8a12-3d81f4a34e0f", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyW5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjK5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742105, "uuid": "d24737e6-888e-490a-b082-81edefb04cff", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742105, "uuid": "b74af4a1-4c63-4b0d-9271-11f2403b6ce8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742105, "uuid": "e827111a-c62d-4a1b-bf57-b7dbaa268e35", "value": "abfb5c33b26d5737f2b3abdf934ae414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f992abb7-4d13-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637750872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750872, "uuid": "d18a5da3-a0ca-4e96-b6c4-55712a1fc197", "comment": "Malware payload", "value": "72fe4dbbc93c2959ef962aced683282a", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "ppsx", "colour": "#84F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750872, "uuid": "f8ca5d31-b7ef-49dc-bb08-8ed94d1f88cf", "comment": "Malware payload", "value": "cac494786970961b0bd648f430892b00e014164088a49e16c5d9026b229ac852", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "ppsx", "colour": "#84F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750872, "uuid": "94e2a0dc-b37c-42b1-a8a0-e6c3fcfa5e27", "comment": "Malware payload", "value": "cfc7b6a3ecc2874f89edbfded3dfe9b26c2b5ee0", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "ppsx", "colour": "#84F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750872, "uuid": "64d0d19f-b482-478e-8586-6ba9dc53bc7d", "comment": "Malware payload", "value": "87bd95bee5b4d576c6e39adff7039f96f77be2e32bf5ab5b688e3ee773bac35af859031f2075a6c8f390105446ee47b3", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "ppsx", "colour": "#84F264", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750872, "uuid": "4ebd204f-cf46-4a12-8e95-41e29e92a87d", "value": "T12D46338E5F53DB64EFE3A7BC195A899B0542CC360A279A41D3805C40FD713CA1AADC9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750872, "uuid": "3f12382d-a076-442f-b9aa-fecf53143c2d", "value": "98304:SE2uxRPdiun1UuG+A9BKyyTOWPUWg0XslE2uxRPnrTk+rqlmAY8KQaiTu8U3J7MP:CuxniunquE9BKyTWc308xuxdQNY9ts0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750872, "uuid": "65f81e2e-54a6-4774-ba9c-b3da66ff5782", "value": 5590398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750872, "uuid": "6ab7ccdc-2b36-46fc-883a-3fde1f45b871", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750872, "uuid": "d3317991-da04-4cad-be1f-ffd2f8dfce5b", "value": "online workshop.ppsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026278e9-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637772362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772362, "uuid": "ea069179-94f7-4be8-a85d-140ac08af28f", "comment": "Malware payload (Dridex)", "value": "b6c09b88eeb411e648f688e7ca6a1ca9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772362, "uuid": "d721f217-5c8e-4907-a496-dfcd4b77f937", "comment": "Malware payload (Dridex)", "value": "cb53bf4394e7f77534ca8bfa1039fc76c50a54be4dce411926dbb594a1a55c52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772362, "uuid": "df811180-b19b-416b-b674-b241e69bd6a7", "comment": "Malware payload (Dridex)", "value": "da6a58fbb01118bf77842f75cb217c3cf33ded2f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772362, "uuid": "58ca1348-2573-4448-be58-113c5c8df29a", "comment": "Malware payload (Dridex)", "value": "00b8fdaa4e5337e9b6f226fdc815a816cff64cce188bd0815ee39314cb488b2445b5ed61df002653a378b89b7f32cadd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772362, "uuid": "fa1ce82c-adcd-4ae7-9ea6-21fe17678935", "value": "T1B683024FB2273C84C522383F816B4AE3391991566C57BE85307296E814F93679FEFA34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772362, "uuid": "54228589-8387-4d8c-a5b2-eda819ab2fca", "value": "1536:UWLP2CET+S+agP7nA9u9DE23j/iuRPk4OJ2QspRxW+gdFx:V0T1k7TA+jiq1i2QspRk+gdFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772362, "uuid": "8fc9359f-5339-4e62-9c0a-5e5f6f309208", "value": 84285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772362, "uuid": "40b51d3d-9624-4ba6-a5ae-69a12c6e0734", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772362, "uuid": "fe5a4a06-2eb5-4726-8a36-af50f09fa5c1", "value": "promo code83874071.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96024ffa-4d16-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1637751994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751994, "uuid": "0a3c7e35-84a0-46f1-ab55-542261758158", "comment": "Malware payload (AZORult)", "value": "fe76477647f3a78f6d36801295a6ae61", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751994, "uuid": "a7e593d4-a486-472a-87a2-ef37ea10bb45", "comment": "Malware payload (AZORult)", "value": "cba28f8f5fdb89f8574a3da19c0ee289b1f7b4e8fe238743921e7ce2110854dc", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751994, "uuid": "a0914593-ba94-4798-a9fc-0089562fee38", "comment": "Malware payload (AZORult)", "value": "ee1d55674036fc9cadb8c31835685942dc181b9f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751994, "uuid": "73445501-7168-4a0f-87b1-ae35ca302184", "comment": "Malware payload (AZORult)", "value": "ba9593b4246414137faa9174e5973a037124a085b84b2dfcd167b1e387a961ea23125a050add3f5810e564eb188e88a9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751994, "uuid": "3e8c5961-4765-4d2d-9732-3b9c4d6c124e", "value": "T120B3197AF6C19672E02808BDCD46D1B6912D76302D3918B6B2DA4F8CE5F95C26E1C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751994, "uuid": "b3959400-e29c-4b17-8c05-e7cb893821fa", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751994, "uuid": "053a0370-b5e9-4108-bc30-135f75e87cd7", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/jxg/:Zzx7ZApszolIo7lf/ipT/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637751994, "uuid": "3e3912c6-69e2-436b-8a89-2a3adee48d5f", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637751994, "uuid": "86c980bf-5302-47d3-93da-e7a2d473339c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751994, "uuid": "832f38cd-201d-4f9b-9b60-2a3edcb0ff8c", "value": "fe76477647f3a78f6d36801295a6ae61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d232d2-4cd1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637722204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722204, "uuid": "9c5408c9-f59b-4341-9dcb-1e39068ebef0", "comment": "Malware payload (Mirai)", "value": "dc31d349e76ea4ee466d0e2985a19a14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722204, "uuid": "0b3ab3bb-85a5-4eae-b6d6-47f380d889c0", "comment": "Malware payload (Mirai)", "value": "ccf07ce27bf6e19ad17990c44d32bf85e43112689842002c0a4d77fcd96cc60f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722204, "uuid": "f46f0e8b-0aad-4cfb-9782-06b231b51a33", "comment": "Malware payload (Mirai)", "value": "633b0d3ed332514640b0d69e9c7fa05c44707f19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637722204, "uuid": "29894465-fd7c-4f09-bbd6-834af3ee598e", "comment": "Malware payload (Mirai)", "value": "b7e57840a8ec31377e8d8e3d0ba15e8320001f9c63449205f380d24b8ca2b6a954ae93553cfd6dd0ba30d51c638a8d5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722204, "uuid": "6a32d708-8575-4f7c-a8b3-75246ec18a82", "value": "T1C093744D3E219F7DFFAC823887B75A21964823DA66E1C585D05CFA021E7034E741FBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722204, "uuid": "1759d8a0-2127-4f93-bb3e-ee366a474b45", "value": "1536:4YRS2cWY6f6utWSVSDYFMMwqZ9ad2R0vf7y9vnk5zlf/A4mqvrrb94K2M:1I2cWRyutWCSDU9a+0Hm9Azlf/A4mOrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637722204, "uuid": "8fd90665-afc7-4255-bc1f-092fa99933eb", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637722204, "uuid": "5e21421a-bae9-436a-af2f-61b51f14f59d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637722204, "uuid": "ec33d5e7-a0cb-4d17-92f6-185b1288bd8c", "value": "dc31d349e76ea4ee466d0e2985a19a14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116e804b-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764656, "uuid": "f682d732-77a1-4fba-b6d7-48fa7ecce924", "comment": "Malware payload (Dridex)", "value": "137b47d5957763285891caf84b76e884", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764656, "uuid": "37a649d9-2e08-430d-8ce6-d84d4721abaa", "comment": "Malware payload (Dridex)", "value": "cd9e2bb272e1f06fcf982bd8518c2e034529c42761e39d19a5bdcdf8796512e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764656, "uuid": "17f435ac-8be3-4c90-9381-da79cb1e99a6", "comment": "Malware payload (Dridex)", "value": "a3adc46f1a1636926e91fbbdc3807a89b26215db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764656, "uuid": "e3d7cc72-1faf-473e-a972-ffe7cae90bb2", "comment": "Malware payload (Dridex)", "value": "6ae7d939e656cf954106a44f66d615850b8023faf8b3cb1a7251293df1d6825cee682f859fb748d315e01da48c19415b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764656, "uuid": "911f255e-d65f-4182-aaad-9ad39d1868d7", "value": "T13B63F26A9E5EF450C5F7C47CC29E69F8700A0768ED65E01B78D473049871AEF578B318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764656, "uuid": "81aa2afa-b725-4cca-af29-a7efb7e2c0bf", "value": "1536:UWmPqrE3gpMokPF58Ik4kosQFVvSuM6iipOkSNSD59zN8gdi:VDEwFkd58IXkOFVvM6iEOXUCgdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764656, "uuid": "a3c5b1ad-f9a3-4252-ba2b-82af8712bc0c", "value": 68771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764656, "uuid": "ca2bd2da-3e3f-46d1-b49b-9283cae7c765", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764656, "uuid": "0ea5e545-537d-498c-bf7e-c61f074621cb", "value": "promo 2352017.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb63d34-4d67-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637786638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786638, "uuid": "de65ad7d-1131-475b-81ae-cffec4b82c1a", "comment": "Malware payload", "value": "67818f0816bf6dcbd99a77b4606fdb8a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786638, "uuid": "7bc74df3-beac-4782-84b4-5317bda75950", "comment": "Malware payload", "value": "ce18c8d3909983645f813da240fe1e3be014425585beb800de207f225e3bdbbe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786638, "uuid": "2e82fc3b-554a-479f-a358-7dc85d1a599c", "comment": "Malware payload", "value": "c4f4be1198ee3049185be4225a2137ff1fd3522c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786638, "uuid": "b523f0f7-1932-41f2-bbce-9a43251e2311", "comment": "Malware payload", "value": "94d6356d03a8bc1b33896d06c54a37986e8cd8e7c8c2dccc66bea5eb4f82ebd02d2268e38f074fae98f26af414b79eef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786638, "uuid": "b8ff21f4-c1af-467c-b1d1-fef8946d0dbb", "value": "T124A4BE11F583C133D0AE1430297DD6A60AAD7D304FB499EFA7D45A3E4D742C2AB31A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786638, "uuid": "8021875f-4402-446b-a2b2-b0974562a4fc", "value": "c78edb9d5780b46eaa0956a2852d0a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786638, "uuid": "701f94d8-240e-40d9-94b3-c8feaa51d88d", "value": "12288:kCy25dXCvOvAei/n8fGoueeyju1oN4uYLtyFYeOKNx2U:keAeikfGiee8ERcy6nKNx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637786638, "uuid": "5e5b5e1b-64bc-4cc1-9ea1-2b475079ba11", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637786638, "uuid": "cf6f6d69-a6d7-49e5-9934-26ea60bd4bab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786638, "uuid": "0034cf21-6af8-431c-bc30-609255ab26dc", "value": "emotet_exe_e5_ce18c8d3909983645f813da240fe1e3be014425585beb800de207f225e3bdbbe_2021-11-24__204352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6be5ed-4d67-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637786638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786638, "uuid": "e807870a-33db-4b00-973b-fe1da2cfd4c5", "comment": "Malware payload", "value": "9e7d45a383dc99d57a79cf2a7a67e0d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786638, "uuid": "24e63949-804b-4ee8-803e-41db6dd102aa", "comment": "Malware payload", "value": "ce896fcc7fb5fc6625bbbcfb3b3a20274ef57902d020fd34a673b89ad3edcbb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786638, "uuid": "a79f918e-9dc0-4b01-b2ef-b444089549d7", "comment": "Malware payload", "value": "945d71cbe006e76a0b65cef443c362a9cae70a9e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786638, "uuid": "7091eca7-fb13-4264-92a0-81f019d339c6", "comment": "Malware payload", "value": "7c606c379c1c8122eee9f88fdd74816e4482cab0c3d484fbfb73737d3a87ecd5b2484fd0ce25d7bb153e27ed636ba61f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786638, "uuid": "c5756d9c-8876-45ee-ad7d-a5baf5f8bdd1", "value": "T16DA4BE11F583C133D0AE1430297DD6A60AAD7D304FF499EFA7D45A3E4D742C2AB31A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786638, "uuid": "36c26dbe-d306-4f86-be67-d0ac31622401", "value": "c78edb9d5780b46eaa0956a2852d0a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786638, "uuid": "45ee9a93-6827-43d6-b4ef-05f16d4ea5c7", "value": "12288:kCy25dXCvOvAei/n8fZoueeyju1oN4uYLtyFYeOKNx2U:keAeikfZiee8ERcy6nKNx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637786638, "uuid": "bf6cf1da-f223-4e9d-8581-a79afa8b7f4f", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637786638, "uuid": "1c95161f-694b-4499-85a1-17941724561d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786638, "uuid": "0379feb6-5660-4bd6-87f1-844fbda6f988", "value": "emotet_exe_e5_ce896fcc7fb5fc6625bbbcfb3b3a20274ef57902d020fd34a673b89ad3edcbb6_2021-11-24__204353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7568c0b1-4d47-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637772984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772984, "uuid": "2b84b57f-49b5-4efe-8812-433f635ba3c3", "comment": "Malware payload (RaccoonStealer)", "value": "1f6f686603ba1e0e6d810c21919f0721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772984, "uuid": "698b6864-2ce2-48b5-b57a-e90dcc775f96", "comment": "Malware payload (RaccoonStealer)", "value": "ceb8ba9bc3ccddeb3c748aee458927ae38eafa2b39047499a9f02653f5fdff72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772984, "uuid": "7d7c90c6-80e3-420f-a5fb-de6370149a11", "comment": "Malware payload (RaccoonStealer)", "value": "817316342074c873195719c5d9dcc66c1d264db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772984, "uuid": "995664b1-7850-4549-b5fb-9f2863b55b64", "comment": "Malware payload (RaccoonStealer)", "value": "4cccf5e4ab6de7b32aff6b86602d78f25fa7f12a252f8a60ea824d91245305c264015fd6cf9ff98615c086dedbee81b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772984, "uuid": "d82d2f0d-d0b2-45c0-b11f-7a0fd4c6cdf0", "value": "T10DE3BE2C32E0D436D5A7253168F4DBA11EBABC326676854F3798133F1F702D04AA576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772984, "uuid": "57343bae-9792-45f7-a6b2-e867797640f1", "value": "7fa5c9c2dffd615fa15cdafc116d6f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772984, "uuid": "7c12709b-56f7-43f7-94eb-cdf7e62c67f8", "value": "3072:lxneBvEKHDDtZELe2IJ+OqIMMiM4ODISd6k42:KtE4DtZu1IHYM5pAkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772984, "uuid": "d8497217-5988-497a-b39e-ac58cc974b17", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772984, "uuid": "8c917154-103e-43fe-b4fe-7b57fd2d360b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772984, "uuid": "7b9c59c4-4dc8-4598-9a6f-f0138c551566", "value": "1f6f686603ba1e0e6d810c21919f0721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fae4adf-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1637780196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780196, "uuid": "aa47b9bf-8805-45bb-84c5-c0021252db81", "comment": "Malware payload (BazaLoader)", "value": "3b00b03707c93f6c8c25b4092dd074e1", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780196, "uuid": "b430d750-ba8c-4d44-9d3f-0a95d30a8880", "comment": "Malware payload (BazaLoader)", "value": "d077743292e27a294562add0dae83490213912881c34ee083c2e8b32899eda30", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780196, "uuid": "c9bbbba0-3bff-41d2-9068-97b063e0a0ad", "comment": "Malware payload (BazaLoader)", "value": "a802f1e43517217fd3db05abf57458e041d41a00", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780196, "uuid": "618ea52f-ea0f-420b-b42e-b1e304098997", "comment": "Malware payload (BazaLoader)", "value": "bb9d41a5594cc6c9ce159e8b32ab58cab30418955fb12325a236783886afd4795ab09ea46866802a4999e3df3d6f5f43", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780196, "uuid": "7034e08c-d129-494e-85e0-9ed665b90bdd", "value": "T18A64C0117BD48C98DD77027D88B34805DABE2C325B35AADF0A74259E9F6A3C14C3A778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780196, "uuid": "28656ed5-3f79-4619-bea1-54b2003fca3b", "value": "b01abbf9bba0f1daf3b4d5629e6a666e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780196, "uuid": "5c830d79-4f6c-42bf-bbdc-52de2eddc0e5", "value": "6144:bV/R1DGqitdh9BhgnaTyEJle86HEJwDdVU9wGtD6:hJ1DruhmaJl1HJadBM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780196, "uuid": "74a1cf6a-e423-450b-863d-b9b00cddac2e", "value": 311825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780196, "uuid": "1b9003f0-de59-4a0e-858a-56cb379e2bde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780196, "uuid": "5edab8d7-30ca-47ee-bb3a-638834c7a514", "value": "zJIYacrw.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d1b051-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637779077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779077, "uuid": "999c2552-a0d1-4402-ba12-aa95f6318e84", "comment": "Malware payload (Loki)", "value": "b378fd54db06d3ab6bf7b2075e27af30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779077, "uuid": "69a70d8e-2f39-40b3-8621-757154082196", "comment": "Malware payload (Loki)", "value": "d0ac8819e7e6949064b5012d24f92d84e85ac358ec3b1e58a72a5da2e671647a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779077, "uuid": "e133cea7-02e0-469b-b8e3-2430f8351827", "comment": "Malware payload (Loki)", "value": "d4ffcd09c68567a3b611891fc4adf494c060f57f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779077, "uuid": "48f7cc97-bdfa-4f65-9068-348a145dcda3", "comment": "Malware payload (Loki)", "value": "7c6af5fee7e81aee8c099b6a62f5daebeb79bd65d207be926a572888a0f3a89d3e1ab0fb006bbbb4183414a9dd94bf21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779077, "uuid": "c8347c60-1b02-498a-a19e-7948302919d7", "value": "T1C654E02132956313CCB68BF90C24608853B2B1153D15E36DADC992DF6D66F638B62FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779077, "uuid": "9de0e757-cc77-45b6-a0eb-472b2bf6eb33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779077, "uuid": "d252e82a-9aab-471b-aacc-04ecd0c42eec", "value": "6144:hrQzvIqgJ2ybVV0iWrhC6Dv94i+6zUDyLzUqovH:hUVg1b3/z6z95+6MW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779077, "uuid": "e04e0e8c-2df3-4788-84f9-085fc5531862", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779077, "uuid": "ae8a8bc7-fa86-4039-b24c-939670851854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779077, "uuid": "4d371e26-60a6-4ba4-94d0-01256bad9386", "value": "b378fd54db06d3ab6bf7b2075e27af30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea4be14-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637776060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776060, "uuid": "baba84ea-722d-4b80-945b-4bf50c513ebd", "comment": "Malware payload (Loki)", "value": "34333586a5c803d04ff03c53225cbdfa", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776060, "uuid": "8574ddec-877c-43d2-a3c6-ae23b9508b03", "comment": "Malware payload (Loki)", "value": "d0f3518489d142b096fd17350b556474afc15532b98855b57316c153978f17d7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776060, "uuid": "45157cdf-89f7-4ff8-8eb3-01bf005c9cdf", "comment": "Malware payload (Loki)", "value": "d0c093d9b6f0f9e6f8d86589e3427195d53c885d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776060, "uuid": "248d5f22-36ed-4ec5-81f7-24d53ecf18fd", "comment": "Malware payload (Loki)", "value": "48114a22c86368996b5d4a63e02123db039df8379671a94a30f49cb94f089574c84146f45e88afc8777ece458395ebe8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776060, "uuid": "9ef494c2-cd06-4a69-aeee-e12992eec846", "value": "T10E3412D47366CDC8D12DBF757BCBA8140438FCE0DE2A410EF58435680B76989A4BA6B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776060, "uuid": "f6c111d9-7dab-4324-92cf-665b33033e3e", "value": "3072:Nf4izZwBGM63hf8sl5BaApgJNYVwHoxctA8dG+wIYQ47MDqbHdysNGe3Cm18bjoV:NrOx6REs0ikY6ccxE+whQ4+EHd1SyE1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776060, "uuid": "c91c4b5a-da62-41db-84d7-4d461e22979a", "value": 234424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776060, "uuid": "224d4977-946c-4407-bfb3-3b7f4458f379", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776060, "uuid": "a9259d33-d50d-468b-b104-e0730ff02d6f", "value": "PURCHASE ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e85d0b0-4cca-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637719205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719205, "uuid": "bf3b984f-2fb6-45e4-bcf4-c7e793af75e4", "comment": "Malware payload (Mirai)", "value": "bd23415089427267bdf50edd69181752", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719205, "uuid": "5d5d92a3-d20a-4ab3-aed4-81d62f836f44", "comment": "Malware payload (Mirai)", "value": "d1253913807bd475ec0593158bc56882d8fe88a62d4c15633176264bb41269ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719205, "uuid": "ec21ae62-8e00-4a0e-a7cd-0e1697ceadf2", "comment": "Malware payload (Mirai)", "value": "bc2f272c9b34e9088d2480ad1be238cf42e5c478", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637719205, "uuid": "4d86537d-4177-46b8-9dfe-e1763c6f5471", "comment": "Malware payload (Mirai)", "value": "f031fd81321526052186ab61b9820cdc11604f7585178397e370c8b035ada0af6f93d7eb258dd92185ad5fa62f7f37e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719205, "uuid": "d99bc9b3-3787-49af-af1c-b5f596999c20", "value": "T1AFE33B86EA408A13C0D51B7AFAEF41493322D755E3DB73078D189FB43F86A5E0E63649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719205, "uuid": "51504c4b-a0d5-467d-a60b-00800680c7ea", "value": "3072:JRzLuCdRwqrpGO9b4D7zEpWp9mrsplDKZUiQBKXAVanGX+F8Jyvp4hL9AUIJM+tQ:JRzLuCdRwqrpGO9b4PzcWp9mrsplDKZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637719205, "uuid": "fe5b0934-ecfb-45ef-8b94-2b7b1c8cc995", "value": 145308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637719205, "uuid": "1222c587-37ed-49aa-aff8-9de199e33096", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637719205, "uuid": "e5e9d262-2614-4c0f-b68e-e43c48ef1647", "value": "jydygx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babf9e4e-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637772671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772671, "uuid": "bc17474c-d300-4454-a96a-5f60b1296923", "comment": "Malware payload (Dridex)", "value": "f2236bebbb2ed3026ba36e3903826ce6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772671, "uuid": "8c1f21c8-74b1-4069-a01c-f15e778209f2", "comment": "Malware payload (Dridex)", "value": "d193169de5e8894c719a420fa4e8f67864aa58b7ccba60d6e69e811313fb05f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772671, "uuid": "4fcb10a0-6a35-4e3a-b6fc-863258ef698a", "comment": "Malware payload (Dridex)", "value": "0181fb9bcdbff06faf2185f97fd8a2c99d6e7817", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772671, "uuid": "b6ae6fda-61e6-4916-8e36-69aecc34443f", "comment": "Malware payload (Dridex)", "value": "3cf91544da143eed482eb2fd36499d121ed0a1dab6f1cc1cdde15e221839dc17d47eaaf5dd2b6c7fad1f6562194fbfac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772671, "uuid": "8571832f-ef6c-4ace-ac7e-d214390b4575", "value": "T1B233E12B5316343BC407AD3F9B1A8CF55C19B0F9CC01D6062965AF5B02A92E7D3DE267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772671, "uuid": "d32e3171-5856-43c2-9490-296fe298af20", "value": "1536:UW2PIbZ853SAJbp4pc5w6R31eIjJpQJqgdd:V3bC9pDlemJKJqgdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772671, "uuid": "21a0389c-e136-4dac-89b0-91d70ffccffa", "value": 54924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772671, "uuid": "76334b35-d9fb-4a58-9300-fc41be5716d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772671, "uuid": "676c13cc-d8b9-480a-b3e8-3d8b0b69d119", "value": "license_55683.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c09778-4d20-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637756367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756367, "uuid": "35e18d40-a954-4685-88f8-c80e7b416aef", "comment": "Malware payload (Formbook)", "value": "4163ac9be2d871d13f1377a286cd794f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756367, "uuid": "67b5f35c-0840-4b47-b87c-97c40d9d92d2", "comment": "Malware payload (Formbook)", "value": "d3cdf89cf7b7e951833872e37b9530717a444f419b35b3fc67d7d66a4bacf612", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756367, "uuid": "d3e20002-c08a-42be-908a-d9332512c1a2", "comment": "Malware payload (Formbook)", "value": "7c5bb5ad98afb179dba2e8332e5154c7ec440121", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756367, "uuid": "791fa09a-3d75-4a28-9639-84c2a15228fb", "comment": "Malware payload (Formbook)", "value": "7e322278aeb04ed0bb50f1875469748667fc56f105ee8e9e12b130028f21aaf011e42ebdd72b3ced3bbf8f4677a1397f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756367, "uuid": "77841f08-d474-498a-a12a-d2888d75da21", "value": "T1F58218ACC44742958F85A7B82B1B2F89555DB63DF781D233323CA73A27C2C76812283D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756367, "uuid": "b98c197a-2f40-495d-9b69-7c88418f926c", "value": "384:xShFsCk7qOyEu1qe1xGTnejFx4IL6XOGq9CQxaYxl+TX+gS:xiFhiqp1N1xMejFxZMq9CI6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756367, "uuid": "a420c20d-79e9-4f8d-a8c3-cece1db0dfb8", "value": 19082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756367, "uuid": "ae0e978c-db80-4870-b98a-39534f167dee", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756367, "uuid": "4d3332fe-67f1-4709-badb-9f649f72f079", "value": "QUOTE20212411.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd53c871-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637780460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780460, "uuid": "90c943ff-d395-4a0a-a29b-e9ea01cbfb81", "comment": "Malware payload (Dridex)", "value": "810c5b4097bc09b13f50322f814a76a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780460, "uuid": "27ce2f49-219a-4b5c-a9cc-6880ac72407f", "comment": "Malware payload (Dridex)", "value": "d4dc61e5806aaa213d4d5694d4764f397454e82701d2b643d328e125cb5fd81f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780460, "uuid": "bf0a1093-9144-4ecb-b80a-6d87283822ff", "comment": "Malware payload (Dridex)", "value": "891ddaf40e2c25088b00729e4213cd08968b2c9f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780460, "uuid": "3a6e293b-f6c5-4b61-9c7b-f5096f542dea", "comment": "Malware payload (Dridex)", "value": "50d6850d81f6a2de6069c4291c56a07f1fcf8fc990dbda400ba6a0772c425900c66a0fe706fc198680279d27496629e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780460, "uuid": "169501c5-b599-4e2b-8121-3408120a964c", "value": "T180F4A005AF45184ADB1ACA342B3BE705BC9FFB1065FCAF3025654BEE157768E640E22C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780460, "uuid": "3758a3bf-3466-46a9-be9b-423b46a3ad8e", "value": "e32f79a56269ae02e47b49c1ae49adb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780460, "uuid": "37ed9a48-eb93-40d0-8721-ad1a3f99f9ba", "value": "24576:Zdi7RlnpzHL/R17VZfGCOeeSYRRWXNplL0:bi7RlnpzHL/R17VZ5OeeSYRRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780460, "uuid": "dc6cebe6-87cb-4141-8fc5-ce719ad5a49f", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780460, "uuid": "6f7b7962-f972-401f-ba2c-a22bc810a492", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780460, "uuid": "f8d5db9f-f946-4b6b-b104-2fdce009e3bc", "value": "810c5b4097bc09b13f50322f814a76a1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce686a6-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744462, "uuid": "ca158f58-e15b-426e-9ef7-e30817589886", "comment": "Malware payload", "value": "612ec0fb19138c4222ecf0459bbd3c22", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744462, "uuid": "a6f4d44c-7197-4360-8553-a1bf49e587a0", "comment": "Malware payload", "value": "d50b3f85b61c546122ccb480428f9030f2cdf6b75addfbb84aafcf2ddc1afb3f", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744462, "uuid": "04ddd4f6-3ad7-477c-a9e2-d5205e8c84d1", "comment": "Malware payload", "value": "6653c3c9275341dfa45c3dbde239161a3f0c30a9", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744462, "uuid": "5d7b8a4d-55ee-4dc6-ae3c-729f71077938", "comment": "Malware payload", "value": "44b45e1c6c34f7dcca8654a90565a22d78ec42a11d26b9e791ef8658300fc34dd7f4a3eed623b04ff8ce9350a12b501e", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744462, "uuid": "f9fc7806-c58b-487d-a049-3ecb1762df53", "value": "T19CF533395E37ACC7543D2616585683F39221BCE90C28F425E3FE9ADD348E5F498C2BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744462, "uuid": "6059f8b1-c20e-4556-8beb-c38063d20697", "value": "98304:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKR7O4gLtubex6E6H7YcpR:R4FEQETHt3/b2TdR7Xgqo6F3pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744462, "uuid": "fe2e483d-019d-44b0-9280-56e039e06d47", "value": 3366912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744462, "uuid": "b3a21041-390e-4ac4-8f0b-4004a463b263", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744462, "uuid": "931dc655-41d5-4457-a6bf-a8bd097ef430", "value": "d50b3f85b61c546122ccb480428f9030f2cdf6b75addfbb84aafcf2ddc1afb3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28747923-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637782304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782304, "uuid": "ca0f007f-329b-4350-9d76-070375e7b91d", "comment": "Malware payload", "value": "b2e24bc0f1f55f2ac9d8034098dfe32f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782304, "uuid": "5a456d1b-a328-4566-aceb-3b5ed9c7d090", "comment": "Malware payload", "value": "d5ace58c68d1ff767b284deb172b5ce0550e96023a509a171fa7b34f0929b8e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782304, "uuid": "025f6bc7-57b8-43e2-8add-9b4d2239db9e", "comment": "Malware payload", "value": "4a20778acf6d512792077dc339f23acfbdf22875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782304, "uuid": "30d39a9a-892a-40a8-8762-2aa14a3416a4", "comment": "Malware payload", "value": "138aeeab8cf7ce302957fef21c65976d5d5f76b584566338545f5f25e6636717255268e1a29405e58d7f5aa812781d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782304, "uuid": "ea62e47c-cc0e-4889-a86e-1a45889e9fa8", "value": "T141C37D8239E9B419C389823DE085AEF44E117C114FCA0E6DA9CC7F493B7A7123A5B57D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782304, "uuid": "60d8b37b-8055-49df-a468-a3c7321a2052", "value": "995d60149de3040b4890e5871343f4eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782304, "uuid": "fa9d8fac-1c90-4c0a-bf8c-bc11f308c344", "value": "1536:I+3sCKWgen7J84YCrMYpNxXeBwodguvRZkVT7yaBOJzFHKAgYX5:I1PX0JLHrJNvoPvoVT58JzFh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782304, "uuid": "e7c82e39-a2ce-4dc9-8ba7-40e18277b996", "value": 128816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782304, "uuid": "48119e89-31a6-4647-81f3-a32142401dd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782304, "uuid": "3b833200-a823-4e74-a4f9-1d0598fb00d8", "value": "Hong Tak Engineering SB Payment Receipt 241121_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d698d4-4d68-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637787004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787004, "uuid": "43b7bfc1-5945-4e4f-a7b9-bb3a21a6620f", "comment": "Malware payload (Mirai)", "value": "de4aec98622002bded8ec7dfa9e5f296", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787004, "uuid": "04f141d3-4c4d-4082-a5a1-5da08f356481", "comment": "Malware payload (Mirai)", "value": "d62e6e3dffb1aa2e5d83c984bd45d9581f882d9591bee1385fa9ceba66db4803", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787004, "uuid": "bd5faa6b-2d73-4005-93fd-7aedf1b3c02b", "comment": "Malware payload (Mirai)", "value": "7126348ff5c5c5d51f4fe4b675d4b63183bd6e17", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787004, "uuid": "c25a3e90-1b04-4c06-a048-2a9b184b92c9", "comment": "Malware payload (Mirai)", "value": "c6997050e58aab8fae3629fc08b296a97be480a7b4380dcdd1b9aea2d63a336d49a0e8e84bae1f3624b864e22d113a80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787004, "uuid": "86d0353f-8714-48dd-90f9-5aa1d0605782", "value": "T12BE35C46EA818A13C4D5277ABAAF01493322E755E3DB73069D185FB43FC6B9F0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787004, "uuid": "3c363360-b62c-4118-9bb3-c25cdd548969", "value": "3072:Sknf+lQiHjLEqZzPg95jSPswdwQ1Kbc+fFftM/9Zy9W8pj:Vnf+lQiDLEqtOFSPswdwkKbfFFM/9cUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637787004, "uuid": "fa2d87d3-011e-42ea-8612-e00db974a1b9", "value": 143673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637787004, "uuid": "f40bbf54-1af2-4164-97a0-ab5246204314", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787004, "uuid": "eeb1aa8e-1423-4f27-8f17-7f0ee79684f0", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2248db35-4d27-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637759101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759101, "uuid": "3802ca6d-76c4-4917-996f-8f0da3aa2660", "comment": "Malware payload (GuLoader)", "value": "9c8b626668e14aeb4355ea39d1520e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759101, "uuid": "e1e15213-f7d7-4c92-aa42-280b9e27be5b", "comment": "Malware payload (GuLoader)", "value": "d63ed0450efe28d525954d84556394f21df1c2d882e74b4891492fefab00dd79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759101, "uuid": "574bc140-3cfb-44d2-bb6c-f5eb576cfcf1", "comment": "Malware payload (GuLoader)", "value": "554069b1fb3a80a02840158d31c6c2826812cb40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637759101, "uuid": "8caec197-7eff-49be-9b1a-4ee1793e775f", "comment": "Malware payload (GuLoader)", "value": "8e55d9ce41b7a58908871cb212fbfe4851ca4eec3627a6c8db7f6d2eda492553a20876a423e6c78d07b9d751f57d7139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759101, "uuid": "2f948512-8441-4e96-8d8f-d4743a7a97c1", "value": "T1FCD37B7732A7B84EF1038CF4D26642F41045B9313F98494BBED4226B19B78DEE99C386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759101, "uuid": "58bdab3d-fb2b-40bd-88be-87ed1a4ab876", "value": "d77040f4614bccfda7b8aa2e04863738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759101, "uuid": "5417e56f-fb20-45f6-b3ea-34d2e0822331", "value": "1536:tGDSlb6oBiIOhMk98Riy6NaXuknILxq+o7g8r8A0HiD:tGAtO198yNa/SoXIA4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637759101, "uuid": "928305e3-aab1-4397-9bb5-e06670c8e560", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637759101, "uuid": "623f4a23-4e8d-489d-bf8a-99bb166c1966", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637759101, "uuid": "a163421d-531a-4257-aedb-7834be585366", "value": "Statement from QNB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef519c30-4d5e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637783067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783067, "uuid": "11969d5c-bf08-4927-9a5f-75aeb8e3f026", "comment": "Malware payload", "value": "ee8afde1ba3bb725f5b159e6d6a94ad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783067, "uuid": "20cd6547-59fa-405a-bab3-fd740d1b1572", "comment": "Malware payload", "value": "d6715d3398a1404dd92349e8a58aaecdeff346b02eb014900983046f156c5855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783067, "uuid": "3ca3bee0-4dcc-457c-8fc8-8c83ca7d6ad1", "comment": "Malware payload", "value": "da7ce2ead57b8c60ba373c9089a0e5288c022bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783067, "uuid": "21366ffc-c15e-45e3-a264-bd5edad7d086", "comment": "Malware payload", "value": "d1876011bdd52afa2e8dc65e62c20960e096a7bc4629b7da2e4808489ac48afb0abc18ccfc1ac8e763fa9da72652336c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783067, "uuid": "9887877a-3dbb-4d37-9429-66af9bc8f9f5", "value": "T179D2C6460BD7CFC8D6468E38FF2A1829E0B1A854E49E7D0CFB51386FACAF0757652605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783067, "uuid": "a2971f2e-d856-4228-9961-27c4520c3dda", "value": "4f6883c43647a7c0cb3e4b6dd1a096b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783067, "uuid": "c5c71b1b-f785-4018-98bb-bab0ad6321b6", "value": "768:Bt4IZEtyagm93CJt8w2i+ZG7DyU4Nz5NNNYNNNtmNNNCNNN+NNN4NNNNGNNNGNNr:n4iBagmIY++Zg4Nz5NNNYNNNtmNNNCNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637783067, "uuid": "8d8dbac8-f428-4326-94ea-863a75391e37", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637783067, "uuid": "a54a7f11-682e-419f-bd96-ed27a8fef42d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783067, "uuid": "ac59abb5-c0cf-409e-a395-10d81dfc99c6", "value": "ee8afde1ba3bb725f5b159e6d6a94ad9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d76af1d-4d6a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637787950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787950, "uuid": "4e17ea15-4bfa-4f8c-be6d-ce9b7f10552d", "comment": "Malware payload", "value": "ec35a67f36638da0dab11b22b55903a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787950, "uuid": "75ecedc7-d84b-4086-807e-26409c5d42dd", "comment": "Malware payload", "value": "d819fc8837ae74060dc9f17ee40cc6df2f965c335ba9a4ad4a33e1a20152bab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787950, "uuid": "b3942da5-39d2-4fff-a238-fb88afdbc137", "comment": "Malware payload", "value": "86efe22207751a8646429222b62632a94452af50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787950, "uuid": "5a24a419-ff15-48fa-875a-a488ab0cfcbe", "comment": "Malware payload", "value": "907f22000706599a9909edbc4510c1bc2777653f926e67efb0542130faa98b40e39f04be25287fb31af824fa5d89118a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787950, "uuid": "e20521a2-350e-4381-a780-bfc1df37be8d", "value": "T149C4371A69670404D9F52B3F0295B84802AE7F772B21F95F1B66F5890AB378C1F09EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787950, "uuid": "28155628-bddb-4589-a41c-15777702925b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787950, "uuid": "d3e9f11e-792a-403a-b509-2369c493e2f2", "value": "6144:uayYr21KRv0ZXH4IRBvLSBoyYh+DtEQQHkSgFgDsGzC8wmWQd6aNU:ui28R8H4+lLSBoy2ktFW/gFHoEod6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637787950, "uuid": "8b9f50b6-75d0-47e8-9829-74ca48e330b6", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637787950, "uuid": "bcea47d9-6293-4f57-a5ab-df1c06838517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787950, "uuid": "98e6f38f-20be-4070-b7dc-ccd43bfb2be3", "value": "SecuriteInfo.com.ArtemisEC35A67F3663.5978.11693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71991721-4d3f-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637769542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769542, "uuid": "dedc820a-3a6f-42d1-8d37-87382ca5c981", "comment": "Malware payload (Dridex)", "value": "863b426ca29f861bd0757fedc4b58dfb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769542, "uuid": "69726046-d5f9-4c89-8a3b-5df183231ea0", "comment": "Malware payload (Dridex)", "value": "d8641ffe9ca7a1d045fa011eaec67cc60130fcde46d51825dbef16e5bc544340", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769542, "uuid": "b66d13e6-9cd0-4639-83b1-e2e4b3ff286c", "comment": "Malware payload (Dridex)", "value": "effaf89487c6ff6df9db48a2a76993d7628c7f47", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769542, "uuid": "bb863ae0-7a40-406b-b647-39713ea2dada", "comment": "Malware payload (Dridex)", "value": "6bc734c0a6f16df56f3ee6a36f9097fe4b897e06d38859d906741238bbe1319600f0995c68caa3b6679dd50b7400ec7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769542, "uuid": "102ab0bb-0aa8-4820-abf8-d32b6399c1bd", "value": "T10E6301AEDA15A5A4C3A8EC3D420C18BAED959CA339C4D2EF59F4F74C06B1347A70C19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769542, "uuid": "1f402a89-4aff-45b6-961c-7daf3faa8fd6", "value": "1536:UWkPZZKz/1eCzbqzLkh/OPvTFVl974oeYoVgdD:VsEz/9qGWPvZVl974dYqgdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637769542, "uuid": "c04c1284-f925-48b2-8a50-f30460b7275d", "value": 73303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637769542, "uuid": "718d35db-acba-4edd-a902-afc853dcba25", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769542, "uuid": "0d8ea4e5-75f2-4d3c-9eaf-d7b11b0b0863", "value": "vote0882037.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70501c71-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637780277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780277, "uuid": "19f03286-23bd-428d-9a11-b2c6131897c1", "comment": "Malware payload", "value": "a1930911b2285de1ac256bf2898173aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780277, "uuid": "b9b49eaa-b2f4-4e50-8acd-21eb721b05a4", "comment": "Malware payload", "value": "d9cc5c89d0e9ca1127a72cdedef44fd08638e45b1421d790a057f8aaa1d06d3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780277, "uuid": "f4962e00-8b38-46f6-b5ac-e2a1fc443cc2", "comment": "Malware payload", "value": "d37f122b511ee502d5a8ec35d4564c345126a73d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780277, "uuid": "ec3c554b-71e4-443e-8b76-290876aab3f5", "comment": "Malware payload", "value": "1cc8c37c564bdfdcc70d069b73d2d79b534280fcf1b856a6693d29901246cad9c698ecf10bd3cc8b8c9a357eb2795ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780277, "uuid": "a25144af-8089-491e-ae60-cb9c7f9b0ae1", "value": "T12455237915F6984DE44CC671FBD53A730796E0921E4E3722513C828A7389ED0AF42EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780277, "uuid": "bdb48ccb-b016-46c7-b1c5-7c30070623d3", "value": "24576:m59K0XPKM9wPvUywKmic3KWwE+92TJhXUH1bS90vseEAHsLbvZPZvOSdW:eV9KvKMcmF2TjUH1JzHYNRrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780277, "uuid": "15235a7f-cbd5-492f-b24b-b1f0a176e17a", "value": 1324151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780277, "uuid": "ee4eef02-d991-42dc-8491-16c6a75a4d54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780277, "uuid": "964fbdba-974d-43b1-a7b3-74a21e57437c", "value": "a1930911b2285de1ac256bf2898173aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4856aa-4cf6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637738156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738156, "uuid": "4ad6d917-0374-4fe5-87c9-7e49ddd1e74e", "comment": "Malware payload (RedLineStealer)", "value": "8865aeec172f9753002f9ce81921b6ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738156, "uuid": "380b3469-8774-427d-b381-3fd3c46aef8d", "comment": "Malware payload (RedLineStealer)", "value": "d9e6fa2ffcb979883088b620f9f3fd452fb5e205a3a7fd74f297cf18c01d2f00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738156, "uuid": "e7e06ef3-bb8f-4922-97fe-012b6d0bb52d", "comment": "Malware payload (RedLineStealer)", "value": "3694be83ceb76657e2ed69982a00a560e04125a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637738156, "uuid": "9b2f3c8b-1f2b-4cdc-bb59-fa474b9077ff", "comment": "Malware payload (RedLineStealer)", "value": "dc101961ebb4cfa7de0967e98372df630d548fbef933e0d4d048c3fdff4787089e1ee2965188b8bf4d1cc7477e5f378e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738156, "uuid": "d697dfd6-ae33-4db1-b05d-cee4d712c10c", "value": "T15ED4A504911822EEC79FD13187CADB33792D553A39858E217C470BB8EF99887B99727C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738156, "uuid": "763108b3-8e22-49a0-99aa-1307040fa379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738156, "uuid": "270a2caf-f073-45f0-b2d2-7bfaa98344bf", "value": "6144:bylchuOKiIZLQRWcaosiNAyOqfh6ft6QgeUE5ZAE/ztv2kTFN6siXQ:bylcWwaTiHT6NpUZE/ztv2kTFN6siXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637738156, "uuid": "b2b84998-6432-46b5-a472-7ccc51416b21", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637738156, "uuid": "c9ce3c47-0250-415d-b0f7-b74695878b8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637738156, "uuid": "f1e81f3e-4e41-4aa6-ae15-2e74724af1a8", "value": "8865aeec172f9753002f9ce81921b6ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b2f1eb-4d66-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637786462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786462, "uuid": "e44a01b9-3456-4b54-8e4d-61382e44079a", "comment": "Malware payload (RedLineStealer)", "value": "35279ad7710a00652c7b478857381bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786462, "uuid": "1c3ca7f4-0b22-461d-9441-5a236641189d", "comment": "Malware payload (RedLineStealer)", "value": "da8063d9eb60622915d492542a6a8ae318bc87b4c5f89713da5a52aa750c760f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786462, "uuid": "723ceeb5-383e-46dc-a3e3-062aa5b48b7d", "comment": "Malware payload (RedLineStealer)", "value": "4740894145ce0b13ebc33e8dc006ef20a6f96158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786462, "uuid": "435ec9e5-c16f-4cf9-8e6a-26450f1a5862", "comment": "Malware payload (RedLineStealer)", "value": "eaeabea9a1e08615bf65c9ea268bd5d46a1deff28c7d1dd07dda1e2f77b30fe15ecc06fbaef93682914d57f2786021e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786462, "uuid": "f244acf2-b9b2-4629-ae3d-625fafb4cae1", "value": "T157344C18274CEE21E77C5A35C8E120C0E3F5DA96D04BE30ABDC034E95D72B99E617B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786462, "uuid": "3ac032a3-b80a-42bb-8d9c-21584a95e687", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786462, "uuid": "a30b37b2-9d90-40b5-b2ab-3c07db9bcbb2", "value": "6144:gn70REWqthB4O9UYiAvsrfE4C4AsyRGJf:s70REWqthaO9UpAvsrfE4C4ksf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637786462, "uuid": "aa469877-2e0a-4c06-ac2b-c9ccdb8ff657", "value": 231152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637786462, "uuid": "df9a6333-e748-476d-ba89-d86fe675e9e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786462, "uuid": "9b2feace-ea55-4c12-af06-7c4d6a1d03bd", "value": "DA8063D9EB60622915D492542A6A8AE318BC87B4C5F89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a07c3a4-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637774200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774200, "uuid": "7df60e76-85ac-4188-97cf-9b694cbfb50d", "comment": "Malware payload (RaccoonStealer)", "value": "0ac0395e8e00df82237fdb721f2502d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774200, "uuid": "31541323-4f56-463b-887b-b7ee84c4bdfa", "comment": "Malware payload (RaccoonStealer)", "value": "dab10e4773c0aa338199b6b595ddcd7cf9e0a17423ca0d488a0130a29048083d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774200, "uuid": "acea1399-7734-43d0-b3e5-df9ff4d1b1d9", "comment": "Malware payload (RaccoonStealer)", "value": "53e36c1b4be7ccf57e13afa0448c1fb071d9c548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774200, "uuid": "1d4969d8-09a5-4625-9ec2-e81672d26bf9", "comment": "Malware payload (RaccoonStealer)", "value": "cd56aa87e55f3f5a4404eddc4918298517168d623b6ba0f86515a5cc6e4c2b9827e2aea177809b54432148c451319ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774200, "uuid": "9346c4d9-00d0-4a5a-940e-b329da4d339d", "value": "T1AFC4E114BBA0C039F4B756F49C7587A4A92EBDE1AB3481CB62C436EA67356D0DC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774200, "uuid": "6609b13d-65b9-4185-9de9-b2fcb4eaab8c", "value": "227bb68f00c01d84de5b7cf57cce44af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774200, "uuid": "56379d27-2cbc-47ae-9f36-a8cac0fb7ecb", "value": "12288:Nis4yEFoMvXWTMJ+hGCr+EKMWvxRMsLcEq1ufwEyly:NisttMvvir+EKvxRHNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774200, "uuid": "7c4cafb8-da7e-4ca2-97d5-a1516591e5fd", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774200, "uuid": "09ccce0c-7877-4acf-86c3-364fbf2cda16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774200, "uuid": "505e8f06-ca6e-4096-897e-86c862b48e96", "value": "0ac0395e8e00df82237fdb721f2502d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e58b6f1-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744465, "uuid": "44872853-dc16-4500-b385-b6c05a6d7c25", "comment": "Malware payload", "value": "c4742aa973b0e485b9b10bd37c43cf24", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744465, "uuid": "ea434d14-b2e6-4073-b907-f0c2d92178e4", "comment": "Malware payload", "value": "dcf6e51a4bf9f70ea80bb0202eb89fc658d4ae067dae1ec30ebd6825c18e4881", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744465, "uuid": "70f4f855-5587-40b0-84a5-cf61b2e6fbe8", "comment": "Malware payload", "value": "cdb5213cd947d27598cc9100409b7ef5428782e5", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744465, "uuid": "fa654309-c379-48ae-b745-01e6a3334b9e", "comment": "Malware payload", "value": "f2aedf2986fddf662f4bf962207273d79ede99f9e9045213f02a45dd99156d74116e8adbb9c1863d85cc6afa564953ed", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744465, "uuid": "8c447f97-7184-40ca-96c7-31437f6c7e4a", "value": "T1E6B5330C1375BCECFD5E052937638ED0C2BDA2E4F942619292685CA85D3F5BD03AF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744465, "uuid": "33fd742b-f4c6-4993-a682-8d129f341542", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lfpr8:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744465, "uuid": "9dc8f308-d4ab-4235-8189-1f2b5a8f3fd6", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744465, "uuid": "a6c71a9b-c374-4719-bf00-9fae0fa41e4a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744465, "uuid": "55bbf465-f792-433f-951f-99877a1ff5dc", "value": "dcf6e51a4bf9f70ea80bb0202eb89fc658d4ae067dae1ec30ebd6825c18e4881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3647294-4d5c-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637782188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782188, "uuid": "923481f1-8e3d-44f4-9838-7d2c3dd6acf3", "comment": "Malware payload (ArkeiStealer)", "value": "dfe500f58ac8d846e62bdee2792453fe", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782188, "uuid": "df30cde1-9c4f-41c1-bae5-2384e9a4e2a4", "comment": "Malware payload (ArkeiStealer)", "value": "de3a1a64b8785d8021ed4920618c46a4d1c9a72dede140eee6d76eb8a747f59f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782188, "uuid": "c8802856-b8ee-45d0-a9d9-30dc7d58a629", "comment": "Malware payload (ArkeiStealer)", "value": "3b0657974654e1dc645676aafa050adc13ba71b2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782188, "uuid": "398394cf-36a3-4e23-956b-3ba51e2d5626", "comment": "Malware payload (ArkeiStealer)", "value": "d14e69cfe16a1bc47efb89a33bb5a042e105e641a6e86e9e893f5675bda0c1b2065087c252cef5fbf32fc4af905d1a76", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782188, "uuid": "bad7cc4a-4605-4ba9-a656-0ce078605c30", "value": "T15914DF20B2A2D832D4A7563029F0C6651A7AFCB26774814E3758173E6F70FD24A763B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782188, "uuid": "edf6a241-92a4-44a8-9736-4d876d5ce520", "value": "c53a5a8e9ef3dbd0aff245de270c9709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782188, "uuid": "3607da43-84ba-4599-924e-ebd610de4312", "value": "3072:juroscppoyvMp7koybrNp8MWXkxISKC718PnZU1AxWQ/VTQB2:j8oscppoy0Wn8BirKk1mnGZ2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782188, "uuid": "e7f9a54c-00b2-41d8-b99b-63e92f477b4c", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782188, "uuid": "7fcf07af-3282-4c65-b8e3-d801c99a320c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782188, "uuid": "f059e646-e26f-4b81-ae54-e5c09eeb0c64", "value": "dfe500f58ac8d846e62bdee2792453fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04247d52-4cba-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637712235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637712235, "uuid": "17307742-8246-49ff-9932-4da5af96e502", "comment": "Malware payload (Heodo)", "value": "9b3e350f3cdae1849dfa1011e3f54158", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637712235, "uuid": "2a431424-f53c-42e1-b29f-9eda53e631b9", "comment": "Malware payload (Heodo)", "value": "de77d9a33a526a2f4538b6d9a95575bfe7cba4b9ab4c9c6c1572b0b79883ed9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637712235, "uuid": "b891142f-f41e-4226-8189-4400afbaa5ba", "comment": "Malware payload (Heodo)", "value": "89b2b01fc55dc43b6929f069bda44bddb074e8d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637712235, "uuid": "da528f34-c3a6-434d-9e5c-a28d32a8e3bf", "comment": "Malware payload (Heodo)", "value": "584ab5c29d61f57ed13b4ebe0f018cbc660fddb1b66b6622a743d2f3595e8e07ccad22216e16cb09be9ff581138bdfdf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637712235, "uuid": "4231e44b-ed78-4dbb-a20c-199538b85335", "value": "T1A4A4BF20F5C3C072D1BE09307978DB9609AD7D304FE5CAEB67D85A2E4E341C15A39E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637712235, "uuid": "384bfe7f-9610-478d-9844-115279d451bc", "value": "f81a3c8b673ca7b3a7f6c06eaa20660c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637712235, "uuid": "004671dc-e200-4140-bcc1-b51bfa9ab7bd", "value": "6144:m3M5xEQPjPLlMcp8gvSaX5EAoiAO0X1AF8JOKXDebPG0+Z0C4OGUBbiA1:m3M5Bj5Mcp8Qlwia2Ye6DZrzGyWA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637712235, "uuid": "417d66b5-271a-48ed-b20e-865d6df7e3cf", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637712235, "uuid": "da20f814-1244-4dbc-a790-5e5c5bff937b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637712235, "uuid": "9bbc45ce-8232-41e7-8974-169b4006d70a", "value": "emotet_exe_e5_de77d9a33a526a2f4538b6d9a95575bfe7cba4b9ab4c9c6c1572b0b79883ed9f_2021-11-24__000350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d4d142-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637762764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762764, "uuid": "a8b69fd6-5883-4a61-acc3-d2fee3d65fea", "comment": "Malware payload (Formbook)", "value": "3d37488e03dbbc57942e789c12857309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762764, "uuid": "f24b706f-f448-48c5-a949-27bb3f17fb78", "comment": "Malware payload (Formbook)", "value": "df70c8209f25283b9f315676eb12c7ea09c683501386f1290e347f70fb4079ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762764, "uuid": "b502785f-3c82-4a42-8c0d-86fd2931ee3e", "comment": "Malware payload (Formbook)", "value": "4ab062ae7e02c5f0538f667c11d6bcc7117acf62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762764, "uuid": "9235efcd-794a-4c81-91a4-88a3b4b6705c", "comment": "Malware payload (Formbook)", "value": "aa858e0a264a474d86f723db09572212cfd6b54ebdc13a47506404a9d722ca0497c40a7ac1223d1026ded2bde706160b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762764, "uuid": "92abad9e-958a-4652-8f8b-4951cb17dfc8", "value": "T114B4F1663A56CA42E9290732C89E40840331A50539D7D73F7CDD332E5E267D3BB16AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762764, "uuid": "74ab2d97-6df3-4f61-b053-6b02fdc4fdca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762764, "uuid": "d1ca1936-60be-433e-9f21-e3bb23d55c40", "value": "12288:oPsJtD00JAccUbRW4UNJLIxEuRRn1Eq0g:vC06KR0JLsEq0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762764, "uuid": "bc72a539-cf1f-421f-bcd3-7c084783aebc", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762764, "uuid": "0562e4ea-b6bc-4920-805b-782b7370c028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762764, "uuid": "4302e149-21eb-4e81-9315-01d5880bc530", "value": "AWB_NO_9284730932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ca1f1d-4d37-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637766299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766299, "uuid": "5ef84008-0f1d-41f2-b516-beca7c475f72", "comment": "Malware payload (RedLineStealer)", "value": "3ced75b345fe2fff2836591467680eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766299, "uuid": "382174bf-3d52-4bb8-8c74-2f1607fa7fa0", "comment": "Malware payload (RedLineStealer)", "value": "df8d50e1d4b7c75276dcb8e12a454dc3eaafc881a364f465a216b7122a51918e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766299, "uuid": "47835170-5a3f-4cee-91bd-cae600bd8bc7", "comment": "Malware payload (RedLineStealer)", "value": "da8f2eb1797a79bdb86f1e116a3a0681d1db1db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637766299, "uuid": "f7b43cc7-589a-4c93-b642-22f03f27340c", "comment": "Malware payload (RedLineStealer)", "value": "c3bcc236e7cd609afd8e54db00e38f540a5aac9e2f84d850651d8b9d276a7ef0d62d4f540d40dcdf2a3c7b99d7987677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766299, "uuid": "6f91050e-6517-485a-b32b-345b3f862555", "value": "T19F5533E81B48BE5EDAC441B6B7222B56605F1D43E23A52C7F9EA8706D2FC00D719637C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766299, "uuid": "1753f247-55ff-4bcc-8d64-e91cb5bfbcc8", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766299, "uuid": "ad25f6d4-296b-4715-a118-1cb53d86265d", "value": "24576:TttWjMnHjsS1T+Wd144YDsIsFuDDR0e21f8eLEsd8lukEaHNYK38C/UN:h+mT+Wd16YBcRldexd8luNaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637766299, "uuid": "d378f388-a683-49d7-b0e6-09de26b6381d", "value": 1320448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637766299, "uuid": "b76fbf65-f290-4066-ae7b-82006c35b88e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637766299, "uuid": "0851640f-f341-4982-9b1f-bce17d05fb3e", "value": "XLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ad1d21-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637776203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776203, "uuid": "01b86948-88c6-42aa-87e5-076aa5008468", "comment": "Malware payload (Mirai)", "value": "36014c1ee05fa49a9ce39329f2b81e6b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776203, "uuid": "1d45622a-b707-4023-949f-046acd771e99", "comment": "Malware payload (Mirai)", "value": "dfe4ded688ad55d9f5a9419718257a5a9b66cbf250c691ae37c7e4652cc0d1ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776203, "uuid": "6e8af97a-3b40-490e-85b9-e98bac5453fd", "comment": "Malware payload (Mirai)", "value": "e4160500600ae429faa329f54809fd6708262d26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776203, "uuid": "533c73f8-c49b-4607-bafb-1daa5a001c30", "comment": "Malware payload (Mirai)", "value": "83ce5d08e1862fb0892106f5acd9235426f1d65a5dd93f4c19ea547e572c971a639b034534332a81ac6fddb9305d1dbc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776203, "uuid": "562e809f-2140-4081-bfd9-2cf7492acc41", "value": "T1D723F14320D3BA03E43058FA4562CCCDB64AA7BDB1BE77A625490E154C75D92ECF18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776203, "uuid": "c651b89b-b02c-4bbb-9cf4-4420b8bb38ba", "value": "768:lK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFhoF19q3UELWt/iw+kvBGg6+fYtrBHV:N12O1LCNguovDPH7TcrtLWhiw+kvBGgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776203, "uuid": "f0494592-aef8-469b-91e5-c2a6d2225dd0", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776203, "uuid": "035798f5-754f-4f74-80c5-5062479518b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776203, "uuid": "b1701e8b-24cb-4328-a5ec-e7c118368413", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bad23f-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637776206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776206, "uuid": "5739d0f8-b237-417d-b009-56e5afc39a82", "comment": "Malware payload (Mirai)", "value": "d22ad5558036182a9037408e80ac5719", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776206, "uuid": "dac6cf61-ab2f-4bb3-bc52-c25bb0310eea", "comment": "Malware payload (Mirai)", "value": "e26a5779b2003d15043ec4ac249b77f5104b9ba4818724df06274a9dd6ce19a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776206, "uuid": "250e8b5d-b519-43a2-b005-daf2dce51ff5", "comment": "Malware payload (Mirai)", "value": "9fdec2372df67c94baf1c7257cdf4e8fbf8aec0c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776206, "uuid": "8ca585db-85ee-4ae4-91af-f7b238c0f605", "comment": "Malware payload (Mirai)", "value": "00eb93a4298a67391a7a40bbc66719ccc234444a00e5403d0c9d873b4b864bc1c027f34e74e2cfecbaa2c324e7e88cae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776206, "uuid": "e71db309-8686-4f45-85b8-c2674ebf3f44", "value": "T19FB2D0727011B8B387E600775EEDCB43FB801EF8D0E873295465099DEAD5942BAF1547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776206, "uuid": "e68c9301-0951-4cb4-a912-2700afab1595", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pu868Rs3Uoz6:5tn+o9wjfBAZNQz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776206, "uuid": "2b681a63-e24b-4495-ac49-956eb34dc3c8", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776206, "uuid": "2ccad382-29a8-4643-895e-f5007e04a9b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776206, "uuid": "2f16d309-b18e-40e0-9d08-9a9963a5a778", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8206a21-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637779082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779082, "uuid": "012732fa-5d5f-4522-8732-0de15058b552", "comment": "Malware payload (AsyncRAT)", "value": "4813bbedfb4ac4c6b9819c3e0b09ae4c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779082, "uuid": "c21798b5-5f6f-4ffe-aa93-ef2d82667590", "comment": "Malware payload (AsyncRAT)", "value": "e2fceae16b2385a8e596aea841a593482101741ab8f1a3344b95d001dd9ea0e6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779082, "uuid": "b78c2ca8-fa73-4bbe-9ba4-9b4a93aa9887", "comment": "Malware payload (AsyncRAT)", "value": "fdd38066bb0a889d923b9b6ff6a8adcb0bca65cb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779082, "uuid": "a24ff15c-591d-4cf2-ba1c-2bc66787a008", "comment": "Malware payload (AsyncRAT)", "value": "a3d17d7c5bd0f76ee823490238c220ea27acd5b9e0d50fa8907e53b351cd5c544b483ecac4ba0ea708e8968c805fb30d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779082, "uuid": "2c4f4b02-6c44-4073-9c62-4c847ad1f148", "value": "T15F842317DB8859F3E3D409B62EBBB7B8EB775091C1184A46E3746F23694728B0C14753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779082, "uuid": "f4c23718-53e2-451c-8eb0-b98e919fcf89", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779082, "uuid": "c8b3bcc2-c570-490a-b63b-5a37aeababc4", "value": "6144:rGihL1FoUe/5kNiSxj+ProHMJV2gBLOqxIPdZanPkfTPW/XvFarSVkXkfMN:JoO+PM4tp9xIPdZaPkqn5kXkfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779082, "uuid": "082ec032-6959-45f3-ad4a-c8ca308fa034", "value": 375831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779082, "uuid": "6ea73403-ddd1-4c1d-bd83-9aa0981afc80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779082, "uuid": "6f2e1d98-c855-4901-89fe-dfc1c63a796d", "value": "4813bbedfb4ac4c6b9819c3e0b09ae4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247c36e3-4d4b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637774567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774567, "uuid": "fd516a3b-9035-4aed-b90a-71f38eb2eb6d", "comment": "Malware payload", "value": "6afda204c2580cb01b17cef88b995f39", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774567, "uuid": "da9b73cc-f1f7-4ae0-b7ab-7d27e74889a7", "comment": "Malware payload", "value": "e457f0d7588b7c4d10c7957d834d2e5be9be02a781bf0c8045d9d723f8d8fb72", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774567, "uuid": "70a13dde-3776-4b43-ab8e-2b91498079db", "comment": "Malware payload", "value": "e39b85df0e941eec6fe24c831963a85e37e22c83", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774567, "uuid": "135a10fe-ab27-4778-8a64-0b52871b0744", "comment": "Malware payload", "value": "8b470c715cd1b9bad484ef110937966fcacb3db4f371d653904dcdace2770cade86a0357f4468d81f912e4cc31d2512c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774567, "uuid": "b58bf30b-5f56-42ca-8386-ec40f1a149d4", "value": "T151754912B2BD85F7D17336F799DB6365B825BD302A2458062BE83D4CDF35E903922293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774567, "uuid": "d3669dc8-e790-4be5-97cf-3d2aef78058e", "value": "24576:Trr4ywvsxMW5AkN43V726zrsvVwalQ6O8TU+iDe5GYLASA:Trksy7Bzrsp1TPiGGYL3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774567, "uuid": "56d1dcdd-636f-4818-9be5-11ea81aa093d", "value": 1650688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774567, "uuid": "fa7fc972-53bc-4bec-8150-502b4f0e8ee3", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774567, "uuid": "f827894c-c3b9-4ba1-87c8-fb243ab0f731", "value": "_--#mlwin.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fba753a-4d34-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637764761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764761, "uuid": "37f32d6b-c012-4b83-8220-3bf7d0bb6a90", "comment": "Malware payload (Dridex)", "value": "0c25cd45058aaad04f63a57307b8fcbb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764761, "uuid": "d89b8f26-2388-4099-97d5-29543cf41e75", "comment": "Malware payload (Dridex)", "value": "e4ccdefb2bd1d503e272431baa074774a48f12b8adc68383515aab67b9c08e91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764761, "uuid": "28ac6c7d-e0d1-49c0-86ef-5fae0da1d871", "comment": "Malware payload (Dridex)", "value": "c9b84e00bebd5c5177f62bcf3c15f01d64cd0773", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637764761, "uuid": "4d6a6eb6-b25f-4b3c-bf82-16628b068a5a", "comment": "Malware payload (Dridex)", "value": "8229c3edd1ade2d8e58191652bc78af32b243bdf9b88cb9b390ddd4fd04f5816ef34bb754dab4576e87f151986d95dc9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764761, "uuid": "70c018a4-d330-4343-8f4e-8612f276990d", "value": "T17FF48EDDB428F3DDC1A41B3212601B00594D7B9C964B28A9EEAB7CD5F2F4DDAC8D84B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764761, "uuid": "14616918-469b-4a27-885d-9a699e6c80a5", "value": "8c0e65d990aa46afbbebf4269ca1b019", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764761, "uuid": "6f4c6f63-6aac-42db-a373-b680a173895c", "value": "12288:vgUMGSOMwSG0umMqCImuoOQa0W2KUdgV+2CFDLhbUy0R+2Xf:WVehI9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637764761, "uuid": "b1756322-56c2-4db5-8873-fe407323a1b5", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637764761, "uuid": "61ec7c16-67b0-4eda-8196-addae1d02a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637764761, "uuid": "d512b2c2-9c60-4c4a-9bbe-f2d9f1315eee", "value": "VREcGZRvOYEWbeanerwopnigga.ogg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e925d2-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637774160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774160, "uuid": "d2a8936f-ac74-4059-b244-6ecde8e5bd23", "comment": "Malware payload (SnakeKeylogger)", "value": "8eefc88446e9c96bc929eac6962d682c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774160, "uuid": "a933451a-031c-4272-9735-87d7d92f36c6", "comment": "Malware payload (SnakeKeylogger)", "value": "e5589fa39f2ac2193d974679d599e6f4f064a358922f3ad99675859efad1f1d5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774160, "uuid": "6df6efd9-13a1-4666-8e3f-9f8b7f7fa975", "comment": "Malware payload (SnakeKeylogger)", "value": "be73ebfa26c337f8b3aac9ce6223cb85d05462d4", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774160, "uuid": "c39ec94c-a149-4634-a640-6c65ebbbfae1", "comment": "Malware payload (SnakeKeylogger)", "value": "ca2cd1ecf8c60ecf847dd9ac79988365f3fbd771619b3ad019fe7b58ab717e45d15fd4efb3351f2b24f8b692f75ed355", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774160, "uuid": "3b1fcdea-7046-417c-9678-83f65c059e85", "value": "T169A31295777E763FE38F8D38540A330FEB950946980A7C665DA9A24F785C4E30302DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774160, "uuid": "e600e37f-b60a-45ab-81d4-689e520178e5", "value": "3072:3DOKZu86S3Roy9uFwZlsaFPOHYonHBxqPZav:3SYuS/IwZltFPgYonHBxqPZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774160, "uuid": "3e436314-a3d2-4875-ae4e-0b68e51588f3", "value": 105342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774160, "uuid": "2a4fbd94-b11a-47ca-a506-8a35b0fd8233", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774160, "uuid": "d7508d0a-594e-4f8b-a5e2-a36ef8da2f8e", "value": "PO.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6490206-4cf2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637736693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736693, "uuid": "78ef0865-5ca3-4d3b-8ba2-63783a72bd55", "comment": "Malware payload", "value": "c9ecdc0b377364b17d68a11b1341f3ff", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736693, "uuid": "7a5ea6e8-4f9f-4e72-91f3-beb16389a3e0", "comment": "Malware payload", "value": "e5844caca8dc7554777439d57e3fc23f522216bf3280259f9c8274e1e6399a29", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736693, "uuid": "d6e0116c-8cd8-48ad-bc07-2b36271164ea", "comment": "Malware payload", "value": "744af116d7a9d49302f77948f904f715da762dbd", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637736693, "uuid": "63650911-abb4-491b-9407-e6717c4cb147", "comment": "Malware payload", "value": "3be5d8ee917153377a95d8ab1539ba65a9c675c7fb619f316cf5f1df63fb21767525eef75adff5e291bc7c7b1fd67424", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736693, "uuid": "b9b01db7-0e81-42d9-9edc-42b83f32ab55", "value": "T140F4336CCA82A56DF59B003247C4B14DBFAA1E581E2E3923F489D2DE1F58BE0EFC4151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736693, "uuid": "85d3c648-534d-4d16-aa37-4dcdeeb79d42", "value": "12288:5QjSYN2/ZYobaH1sJt5BuArT3W94HGMf6llvgIWYkHZ6SdVSeNDfGAX0AHtcbxU:5QOHqoRJtLuAH7fUlIEkHD9NDfGAX9NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637736693, "uuid": "5b4c1f91-ba27-4efc-a50b-5bcde2e6f3bc", "value": 746721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637736693, "uuid": "2f915113-b715-4203-9b7c-c641767886ec", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637736693, "uuid": "3baf513a-701b-47d4-ac53-025a1b1a9ff3", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a78c5a5-4d60-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637783596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783596, "uuid": "91620b44-c442-42fd-a89e-289a4ad7f185", "comment": "Malware payload", "value": "186c6c3d5572aa0081c539a1e008b429", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783596, "uuid": "3cfbcaaf-d82b-4f0a-b633-7d38f808624d", "comment": "Malware payload", "value": "e5f2f28413ce3063d521f4147e381f397df539ae335cf5ef83aecf373686741e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783596, "uuid": "3ff217eb-6f6d-4cbf-bbfe-baae1d17b3e4", "comment": "Malware payload", "value": "d47036b37808391ec5e01702b2f0987eb2987126", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637783596, "uuid": "6d114af1-794d-460b-a907-1653124ff251", "comment": "Malware payload", "value": "913f313a9bc60a37210c4ca961c3bd2690d71555009ba35d3778ba21f06bd4001705630c2aa2ee544a683af8b35fe24c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783596, "uuid": "a99b0c0e-49ae-4d0e-8d1c-59d870163096", "value": "T1FA81A4ABBAA9CD3AC11312352A6242217BB7D373258102AFE95C44F9DF05D85A90F34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783596, "uuid": "b2da9799-67d7-41e6-a1ce-61f13bc7e10a", "value": "4bfde1223391e32fec766cd1d41fa3e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783596, "uuid": "1a57a8c1-fd39-44a0-a9b0-5fcd29ca80c2", "value": "48:6uZt+Z5Wk7Jbm7YVSCnXyJTG3qiwGnpZv8B13aLlzUR:ReZ5R7xm7QSqyJC3qiwYkv3aLlYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637783596, "uuid": "5a125785-cbdf-4ac0-bcb4-26e056f77274", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637783596, "uuid": "48985a28-c845-4bed-8b46-70c1c6ee5404", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637783596, "uuid": "a3a3acc9-9bd9-46b1-9d50-e21fad9ec404", "value": "186c6c3d5572aa0081c539a1e008b429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1daedbf0-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637762529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762529, "uuid": "b3aa4109-09c3-45bd-950a-0ca4e7ac8368", "comment": "Malware payload (AgentTesla)", "value": "8706a44b45140807c8af82c69f192e92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762529, "uuid": "8c4b7787-e581-4ac8-8222-b3cacb3c7312", "comment": "Malware payload (AgentTesla)", "value": "e644c575f18d16b4e432bc02d45c35aff42affc618f7c08e3d9139405e0cea7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762529, "uuid": "4d738ca2-ddcb-4f3a-9998-2636b39b64d8", "comment": "Malware payload (AgentTesla)", "value": "6e1b6f744fd21ed3ea0853c98b49adedf97561fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762529, "uuid": "9a7bd930-6aef-4fee-82ca-01944d1ad489", "comment": "Malware payload (AgentTesla)", "value": "ea094ec88f954302d148af04b302ea54a37ca99eff279c865ea51522c72eb657921aa19f432e56e5b4c7a0c257ac7ffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762529, "uuid": "5161799d-bc6e-4586-bdd4-8b9ff16a0072", "value": "T1D7D49DAC325076DFC867C8728EA85CA4A720347B570BD207E45316ADAE0E99BDF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762529, "uuid": "819b3383-3103-4b57-89fb-2221d75c1331", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762529, "uuid": "818681a5-d831-4802-b039-8a9644440909", "value": "12288:r2lhntBtp1+TT1oC/UuXzeyfYoaPSXyy8QoBQtD00GEOBvCJWfUnubDjMtKG:r2lhnHtK3P/UuXiyAYyVBQC0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762529, "uuid": "ed85e58f-dc55-4c7e-ac6e-df5f31fb24d4", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762529, "uuid": "1e53d853-62d3-406d-99f9-ba07707c9fbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762529, "uuid": "d731cf42-8d3d-4314-ab49-ce3e72bd93d2", "value": "50008248-SWIFT Copy, pdf ..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daa1dd2-4d12-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637750208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750208, "uuid": "eb6d8343-836c-4543-be50-9f051630b917", "comment": "Malware payload (NanoCore)", "value": "9d64fa92ce93c242c09947e6a0a892a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750208, "uuid": "db5a84eb-0042-464f-83e1-2a15484ac7b1", "comment": "Malware payload (NanoCore)", "value": "e6a01ce5b7532b69a312fee870b244d1df1a6cac00551981c850ce38edc79af5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750208, "uuid": "d2e6f6fa-cb74-46d5-9488-ec2e2c4548f7", "comment": "Malware payload (NanoCore)", "value": "463c942e70fee74aef894c0da58277c884d8c6bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750208, "uuid": "84061375-fed0-4a4a-9b33-dc2043c2ca81", "comment": "Malware payload (NanoCore)", "value": "884a82d7a41b42c25a6a35870b472fbc4fbe7048ac43b97876974f57813270f41a81b303dad20a3a872b798c49bffe61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750208, "uuid": "2bb94518-96f1-4fcc-9d79-736f8c5d87f5", "value": "T139C412203295A753C8759FF70921248113B362462E11FF4F6EC82A8E7D66F6F8762B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750208, "uuid": "c673e000-c616-49a4-a436-a0ca5fdc635c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750208, "uuid": "26a7a99e-a128-48ae-9fb9-0904694823e9", "value": "12288:tOL/Mq/d/xj06PDRQtc0DEt1G2AjKVUhCX+U3/4sQ+5C5xw:tOLUm/mWDk+RA+qgXF/4sQ+U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750208, "uuid": "bdc67b55-f947-4573-9bdd-94377dd465da", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750208, "uuid": "e35e6123-8c92-407c-903f-0bccc56d9abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750208, "uuid": "67373b6c-10fd-4d55-8474-9cd6a99763f6", "value": "INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0b6fa4-4cfc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637740891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740891, "uuid": "12bdf02b-2fac-4a1a-997f-38a4f1fdd52a", "comment": "Malware payload", "value": "6860658f56596b0d2e7dc9094ac5d726", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740891, "uuid": "6ef643a7-3aeb-4248-9af7-4e126d5bf587", "comment": "Malware payload", "value": "e724ae8b0ec29fc3dc537d4c73be74952963dc9423bc0a47b4b652ed06859de5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740891, "uuid": "5fb4c180-b1ac-4db6-87dc-be42237826aa", "comment": "Malware payload", "value": "8a8926a2b11d2fbd569fdd2fa9169f57ee91be9c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740891, "uuid": "aeb1db9e-138e-418d-83e4-d22ae29d2fd7", "comment": "Malware payload", "value": "eeac852da8bcd660d24ee6d343ec72d7497f8d3339cdf38c207e7e375b829393331562ccb5a16d2def32dcad50ef71dd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-41379", "colour": "#E9B09E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740891, "uuid": "7d33c703-c536-440d-a910-b9aa4558e975", "value": "T1C72501990AE7098CD05329BC0A94E07CF1A8EC66157BD75687F38C5BFE793C1ACC1986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740891, "uuid": "39454d0f-939c-46d3-96b9-5c8453c3e327", "value": "224ba7bfb61e7e5b30045124437cde83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740891, "uuid": "82bda576-c97a-46b1-aafb-a6597521f174", "value": "24576:iDGdzxZcj8Va+orP9pUma6vT/lWmdN08mN9HLZosX:iyd9ZBa+iVpUIv7M+NjmNgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740891, "uuid": "4b1d9362-b959-4620-b778-3fd4a852d3e4", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740891, "uuid": "47a2124e-2805-4652-92cb-a336f981d547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740891, "uuid": "c834fcab-2586-4d5a-88c7-127e4dcc1de4", "value": "e724ae8b0ec29fc3dc537d4c73be74952963dc9423bc0a47b4b652ed06859de5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2c46a5-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744466, "uuid": "febef73b-7302-46ec-8b9b-c500afeb5270", "comment": "Malware payload", "value": "63ace9372cf800c8a46e3710e394b07c", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744466, "uuid": "53780041-a563-4cba-be3b-017a7d763366", "comment": "Malware payload", "value": "e7c69d1f89fd6b0acd937fd3e999c8e64ecc62361f419e2c9f8bafcdac9fea00", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744466, "uuid": "f26577b3-fe51-411f-b5fd-34edba79504f", "comment": "Malware payload", "value": "791a2a33b4b5f456b82103a4b9d80c755f9ca6d7", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744466, "uuid": "37d36605-99ff-4d92-a700-708cfa7350ed", "comment": "Malware payload", "value": "559dc2364d3867d82461539f0eab376d078d12d6dc593365fb206239e4c5a3ed7e1b2a577ac56dc48b1f5d02bfc71938", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744466, "uuid": "eb2c592a-f9ca-4087-b623-2fc869df214d", "value": "T14DB5330C1375BCFDFC5E422927634ED0C2B9B2E4F9426191926848A85D3F5BE13EF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744466, "uuid": "c958a26c-25ef-4e24-9880-5dd31352ab68", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lfprx:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744466, "uuid": "290f2c39-ebf0-46e1-9511-97c6d9fca445", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744466, "uuid": "915e3dda-3eea-48ce-94f7-c9486c6a955b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744466, "uuid": "da4b441c-03c0-4411-bdc6-33ef39f13489", "value": "e7c69d1f89fd6b0acd937fd3e999c8e64ecc62361f419e2c9f8bafcdac9fea00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ac300d-4cbc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637713146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637713146, "uuid": "eafdd635-c030-40c8-b46b-79d126878f2d", "comment": "Malware payload", "value": "4e87cfed63a33d4799b8b3f8b403dabe", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637713146, "uuid": "70af70f0-c456-4d34-a88b-eb5077c8cebb", "comment": "Malware payload", "value": "e86b5f7eb8c8b0ac0249bad8e65688efde39cbe3fb86a954d4b6a33be7f23869", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637713146, "uuid": "64a9ca64-2dc2-432e-a76b-e7eb236c92e9", "comment": "Malware payload", "value": "3c59e41b5ac350265bd21b67216534ca002ae1af", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637713146, "uuid": "ad769e72-14f1-4e65-9aac-5fa49a8ff0e5", "comment": "Malware payload", "value": "3262f98af086f09b04fb957d95d694d5ba2136fff0bdaec08faf27828068deca9dee5df852b316efcea1a2e74b425c21", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637713146, "uuid": "3a2c7487-4c37-4b8a-88a2-acb9ac1a0ec0", "value": "T170759FC78B4C1BFDF2DDCDDD44896097A5E5E0A97C3032D4AAE2AA93BCB7E504031A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637713146, "uuid": "357238f4-0b62-49c8-9ab4-6de9bf2f9fb5", "value": "1536:ZyYaKpezI1J98DaKCDrIzgPwD3gW5crTJBT31c9ULP0ZVBikgVSJXQvpYQF0TRAC:/7J1hIcwmZOkRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637713146, "uuid": "25805c12-3c73-4e34-88e9-5b5700c5cc83", "value": 1698788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637713146, "uuid": "c2dc17de-306a-4806-a6a3-fdfc07a45de9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637713146, "uuid": "57c05ab8-d150-4136-87e8-58f6e2f709d7", "value": "e86b5f7eb8c8b0ac0249bad8e65688efde39cbe3fb86a954d4b6a33be7f23869.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15231644-4d11-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637749630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749630, "uuid": "85dfe68f-ad9b-464b-bab7-77e365a1c27b", "comment": "Malware payload (AgentTesla)", "value": "722529b10d1bcc9deb65fa1ef09f1736", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749630, "uuid": "0022d9a0-da17-4c00-aa0c-8b94f649d78d", "comment": "Malware payload (AgentTesla)", "value": "e95fa9bea08e2a02732a4b1f9b7474d6bcbcd7b3c420b698b484c95306172e76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749630, "uuid": "e05b3c5c-cfdc-4265-950a-4a965280d253", "comment": "Malware payload (AgentTesla)", "value": "ffeaef2d804dc879877f9f4cc82b81c40df6350d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637749630, "uuid": "91a297cf-85e7-4f02-a1eb-84330ac008fd", "comment": "Malware payload (AgentTesla)", "value": "7a9748adb4261938811d6ce5c58547f4c7f960707e52cf5d200c964821bcee7acffd216e2a6863850ce952c95ba3f610", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749630, "uuid": "e59d9dd7-46f1-4015-af7e-3b22dba8e5d3", "value": "T1C094012032A46357CC729BF90C2861C823B374567E15C39E9CD961DF2E32F264B6276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749630, "uuid": "69bb29bc-250a-4475-80f0-f99cc30b997f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749630, "uuid": "dc46036b-7b41-46b6-b290-a6b0959b83e6", "value": "12288:3wZZAtVhuyvDLCkTd0DWS8QfLPQ96EdthkSSJJ28:gYwwvxcGgyOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637749630, "uuid": "dcb95c32-c35d-458f-bfdb-0244bcff0ca3", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637749630, "uuid": "126ae92a-374a-4114-9de8-5e16a4d5a3a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637749630, "uuid": "659effd9-36cf-4aa8-a0dc-ab03d23c1b10", "value": "Purchase Order 66034 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3b30d4-4d12-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637750072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750072, "uuid": "011e37d4-af7f-414a-98f6-0fd5e87d170a", "comment": "Malware payload", "value": "4ebdccbd7b606db3e6cbf0395069c8c8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750072, "uuid": "5047f20e-3d1b-460c-847b-9e4768dc7bab", "comment": "Malware payload", "value": "e9f0bbe9fd157b2e8e5a48e366905afaee0c6c9021b2d71ba3ba4c3b3b853be1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750072, "uuid": "0e8db62d-db65-4321-81c1-7ff03f516954", "comment": "Malware payload", "value": "b424e0e593b5f75ac7486777c6a8da052f2e1af2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750072, "uuid": "7b16f764-2935-4b27-a915-0cee7e01cacf", "comment": "Malware payload", "value": "f313bc64ca5831a5425ae5c6dea5f77d728f4af0555badcf1b5e095ea74ec2f3f773d324e472baa70af9e2b96b6ef66b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750072, "uuid": "9f056bb4-99da-48d5-8d62-169833d8ae77", "value": "T149228D3CD601FC1BD12201BDE059C1F5EB1811B7EB21792E2185715E47912C3AB9FA7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750072, "uuid": "ac48953a-c499-4fe1-bd15-2ca022c85e0d", "value": "192:ScIMmtPvcv8EMG/bCcCZOMGg4nbl+CVWBXbG23wMbV:SPX88E7xAOMGbnbHkqqZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750072, "uuid": "1722db3c-cdf3-48b7-97a5-c1a4af1cbf06", "value": 10332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750072, "uuid": "8a9bf9e8-2d93-42a9-8f6c-2e88eb63bdec", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750072, "uuid": "b75ca257-acd3-4028-a19d-b17dc55089c3", "value": "INVOICE - FIRST 2 CONTAINERS 1110.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a7f528-4d13-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637750651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750651, "uuid": "6aa71b8b-5d66-4321-8143-9bc13f5ab519", "comment": "Malware payload (Mirai)", "value": "75ba1f52d9ba3cf4090896489c6fb3fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750651, "uuid": "d50717d2-3475-4f3c-a6bc-6577767a0049", "comment": "Malware payload (Mirai)", "value": "ea08cfc940c4416e0abb40c26e8a3b39678b6793a3cc6cdccaadaf1ad609f0b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750651, "uuid": "1a301fea-c8bf-4952-a206-d5f84394965f", "comment": "Malware payload (Mirai)", "value": "4f94c5e84f3fa2d46f521a494fe5586423dfef51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750651, "uuid": "c7668f4a-2b30-4a16-a285-a99343e7586f", "comment": "Malware payload (Mirai)", "value": "f8750f6a70ec8c906b2335d0b509726b26132d3dcf8c33786c61a3933a809c90228833bc4d760ea04b9d0bff4cfccdbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750651, "uuid": "0b01b319-27a2-413f-b9f6-69cc57203dd4", "value": "T16BC36B25BC7A2E27C0D4A17A12F78722F1F223CD31A8892D7DB00E5DFF596903516A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750651, "uuid": "550e0865-d391-4cf1-9a94-d0dd338443bb", "value": "1536:RjKiRf3ZSAS8eeecHrfmln90LD2gBzGBmfp1ccq75ftFGUyQN:RNR/0Z64hgBS0h/qVPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750651, "uuid": "53c9c459-48ff-498a-ab48-d4d153e695db", "value": 124320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750651, "uuid": "5034779c-77c1-4482-8d35-25b3b2c2d7d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750651, "uuid": "2d4e3698-b6a9-492c-af49-532dd2b0d55c", "value": "75ba1f52d9ba3cf4090896489c6fb3fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d30e05-4cf3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637737095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637737095, "uuid": "1968b2ae-85fa-4b15-8e3c-6859e15a816a", "comment": "Malware payload (Formbook)", "value": "dd9e66e64599aa89fbd84170fcd55edf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637737095, "uuid": "0a783424-129c-4d01-a3ba-2a177ff3890f", "comment": "Malware payload (Formbook)", "value": "ea4a79fa8e25c7b366ed93b850d295274c43e9e033256232e73c1bba0bdccd63", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637737095, "uuid": "55b5b286-ed40-46f5-b300-9649617049e9", "comment": "Malware payload (Formbook)", "value": "5362708e647c3c7cea15bd49da1b11d034fea276", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637737095, "uuid": "964e323f-5565-4087-b2b1-0614d19d24b2", "comment": "Malware payload (Formbook)", "value": "64040fc159c2bf49d7b9503a990cc7db395487b1abafbaad96b6c32758b445d4f5d4fad75e69f8d76ef694598865000c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637737095, "uuid": "5adeb620-c750-48bb-8454-c602ee2ebf87", "value": "T104742367FB6DB12CB9F47614BF75B68B14952FE02398D13A867C04DF20292648930EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637737095, "uuid": "d2ad72bb-44be-4781-9fab-098a8eaf6e8f", "value": "6144:eSfRmcom57DyKEClXbpgWsT62OtNmgDzcMqqTNRQLQ5uTR48bQiq/OZw0g:esJ2KLr2MNmxvkE62lZFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637737095, "uuid": "ab30e1f9-4852-44ed-abac-4db8d2c37153", "value": 370071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637737095, "uuid": "4a135e2c-a43c-448f-99b7-be3891a748e3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637737095, "uuid": "9cc2d3fb-bfee-43bd-af92-380701561672", "value": "Payment Swift 101,647.09.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a270b5e7-4d58-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637780361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780361, "uuid": "52f4f2cb-70ec-49a6-87e5-69aca705d9dd", "comment": "Malware payload", "value": "2d925677b6ee4703dc73c63462271f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780361, "uuid": "d1788906-0846-4237-ad12-f9677fae70bc", "comment": "Malware payload", "value": "ea56cc5372e1aa0b430387edfa17d5713a215dec2cc4ff93a92aff018cef8aa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780361, "uuid": "32493bdb-1245-43a5-acee-a93d2a352f96", "comment": "Malware payload", "value": "2fecbd729ab8439aa3a71ee93d25faab3230f162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637780361, "uuid": "5cd22e64-53de-478f-888e-d0f804bd50b6", "comment": "Malware payload", "value": "527fc59b524181e428d0acf20bf3de45e30f1ea43925119d88d4138c000b281a18825f05549029fe97ed87bb6bda3e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780361, "uuid": "09c3ebdd-d5dd-4dda-88c1-cbec2c88a23a", "value": "T181D3AF1172D0C034D5A766332870EAB8DA7ABCB2F731458B3B581E7E1F607D09AA5397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780361, "uuid": "9b070950-4290-4f8f-937f-ceef5e896f48", "value": "7fa5c9c2dffd615fa15cdafc116d6f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780361, "uuid": "00da22b0-93f0-4684-a662-74e468701b8b", "value": "1536:JyUem3fTUaSfVzc4mniZP0zhZXvn0eTRw0RVI/R4kZIMOu/jY9+iL2:QUeMYjN58NNvn0cK0I7ZIBu/jY952", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637780361, "uuid": "aa38b058-f8d4-41dc-9a70-33027356e801", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637780361, "uuid": "77ccb109-9cdf-4e1e-922c-5fac38c10500", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637780361, "uuid": "b0415372-737a-43a2-9972-e562b214602c", "value": "2d925677b6ee4703dc73c63462271f29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103ebfa4-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744468, "uuid": "6ee05bb7-c44e-4971-b51d-0e6ef609c944", "comment": "Malware payload", "value": "5e55f8c722c0b4e2de0ae1cf7ace8c57", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744468, "uuid": "dc803d4b-01b1-4ba7-97db-49286008076a", "comment": "Malware payload", "value": "ea73157a89f447d6614cfcdac6d724b63bd8443a62939ec29fc4c00003b178d3", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744468, "uuid": "5149d955-d050-4ff7-a46b-d51da75c259d", "comment": "Malware payload", "value": "f3398b22404af2fec1f04953d7fbb934d1b51920", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744468, "uuid": "ae40bab3-3439-44f2-b32f-2d6fd12647ed", "comment": "Malware payload", "value": "f19f609f02b767ca10ceaa68c0906d491aee4e40d61ec4752edf39575c9602985b68e95139c2f5771a8ae21239b07ed4", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744468, "uuid": "fa66bbcb-fe30-4da3-ab38-108bc66a1f3d", "value": "T14AE533794E3B69CB103E2716185643F39661FCED1818F425A3FA96DC348E5F4A8C2BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744468, "uuid": "d2cfd73d-704d-489b-8f20-68d06147a984", "value": "98304:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKR7O4gLtubex6E6H7D:R4FEQETHt3/b2TdR7Xgqo6F/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744468, "uuid": "0df3d18a-2020-45ce-b43a-b1471b7fc399", "value": 3219456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744468, "uuid": "dee4cbfd-5bbb-4b07-805b-776efff31b51", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744468, "uuid": "458ce392-746f-45b0-a4f8-db9291a7cfab", "value": "ea73157a89f447d6614cfcdac6d724b63bd8443a62939ec29fc4c00003b178d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd549feb-4d3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637768381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768381, "uuid": "b26e7b2e-12e2-484c-90c7-1fe46314b95e", "comment": "Malware payload (Formbook)", "value": "a11ba22f907c7b1d3c14985687d4be5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768381, "uuid": "56d8ad70-3978-443c-aa3f-1d56b3c1aa7f", "comment": "Malware payload (Formbook)", "value": "eb584bfbed9a3957934913ce4b910150a37ce5dd59663044186c59bbfda169f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768381, "uuid": "9b2be987-c51b-47dd-8c20-c71b1ab50062", "comment": "Malware payload (Formbook)", "value": "f142629dca684c880aa3882740a9dcceeb19a791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637768381, "uuid": "cd66c119-5c61-43f1-bc6e-00a12cd2ac29", "comment": "Malware payload (Formbook)", "value": "94383f51e9dc863939be5bfd876a45fe7109730d4874310de2753bba2211a8c2e916da707f344e9683a531f5ae0b4c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768381, "uuid": "62b3b391-adff-49d6-a6bb-58402237b003", "value": "T195B4F1353A929D61E4A91677CA8B41480371AA057AD3E77F7CDD332D69027F32B04ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768381, "uuid": "da7a46f8-de4a-4cef-9eb6-cae7e2eb7611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768381, "uuid": "b5ac0f78-6c94-4e47-8064-587626b51c2c", "value": "12288:wkl5BZv94FAX6B4/CqU0c8y1srfyk+uMa/ocWI0xS9t:rSAHCqUD1c+uMeofIT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637768381, "uuid": "f432dd02-e2b4-45ac-9363-b7884b7d815c", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637768381, "uuid": "f79a5878-9bdb-48d9-8c4c-c8613d8a814d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637768381, "uuid": "e169f8c3-d2de-4dfc-b01d-84ccbfa0932e", "value": "jwcvWLwp0CZr8vg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32d319b-4d30-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637763210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763210, "uuid": "4e25e0ea-07ff-4660-bb8d-4a656fe21c0d", "comment": "Malware payload (Heodo)", "value": "980c4d226ea9c995e6af8d4cb6465d6f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763210, "uuid": "195b3547-923b-4baa-94b2-93c3292ddfed", "comment": "Malware payload (Heodo)", "value": "ebf59c0585dcc9e433765c359d614f780b028ac5af94c7306bf3642cd1ad416c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763210, "uuid": "b07d50a3-66bc-4d89-9834-4f1ecc9a676a", "comment": "Malware payload (Heodo)", "value": "c8dc3a803afcc10d462fdcbf9f40dcacfd548c68", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637763210, "uuid": "726dda86-2c86-4076-8db9-efddc5878b4b", "comment": "Malware payload (Heodo)", "value": "adaa3a3c53f41a78bfef080bb83ae58af0c383d7539ce3df5ebff5ad2e1776f188197cfa80204fa7ffb630d5a8d16b1d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763210, "uuid": "8eb8d7ad-1c3e-4504-bd9b-809de226cab4", "value": "T1E0949D1325EDBDE2D5B9173037BBC7C1D71DEE5006A0C86E76C0196A897C093B522BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763210, "uuid": "ecc2bb99-ff14-4068-ba2e-70ca64803d43", "value": "ef559179cbfc08fc57c1e24c241992ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763210, "uuid": "926e65e7-aeb2-4040-b270-cac9c5b4b527", "value": "6144:1ACzUEcRRKxe0DUAldEzpLlE0sepO8+wM:1lxemHQtlE0sLvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637763210, "uuid": "73de3c3c-5d44-45d4-b5a9-987c39cc0ed3", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637763210, "uuid": "828ca2c5-0546-42d4-b459-99d503fbaff6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637763210, "uuid": "037861af-dc5e-46d4-a267-68d63337541a", "value": "emotet_exe_e5_ebf59c0585dcc9e433765c359d614f780b028ac5af94c7306bf3642cd1ad416c_2021-11-24__141325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6c8b7b-4d03-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637743816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743816, "uuid": "565a3229-c9dd-4df7-bb8f-fca7b6d5f6c0", "comment": "Malware payload (AveMariaRAT)", "value": "af7498d8182ef9fc8c46dbf717da3f64", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743816, "uuid": "cf8f56f2-9688-409d-af4b-946ebc68c2d4", "comment": "Malware payload (AveMariaRAT)", "value": "ec0f40fce45ce545e11e84999cabb7ad9c38452953cef0d4e318d571424b68c3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743816, "uuid": "46ec7bd5-62dc-4818-b2bd-2f868208ff97", "comment": "Malware payload (AveMariaRAT)", "value": "79eafcdd80fd9036008addae848b212ea0d1ef24", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743816, "uuid": "43ad231f-177e-4266-bce1-fc2586d234cf", "comment": "Malware payload (AveMariaRAT)", "value": "4faf6e2b4b4febfdbf1b1ceba7fab208722dbca547e0615397e051905ccf2843fd29e79db3e860eda477e3070640637b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743816, "uuid": "49b3b01e-22fc-41ad-b28a-90bebb1d77ef", "value": "T150D4AE456680C510CC3E77B8E42B88FC03667C57E975E21FEF94BD783AB31D2952628A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743816, "uuid": "68e98f3a-d44b-4542-a796-63c69cb76232", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743816, "uuid": "ab3f8a22-6ae7-45a8-88e8-28afd19b0bdb", "value": "12288:QQDiUMNi2iNvuCtD00CLpyn5b6WxsllY/XOMa0pySZH:Q4iUMNi1HC0CNoCllyX+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743816, "uuid": "de5f6aa2-826c-4147-a6c7-85560cdab050", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743816, "uuid": "0d30b803-566c-4430-80eb-ffee0c554c0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743816, "uuid": "21b7b506-fcdd-4957-9d4f-1bea34f303ed", "value": "INVOICE0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba56ede-4d57-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637779947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779947, "uuid": "e283476d-45d5-4b14-9ca9-bd3ec4e1763e", "comment": "Malware payload (Formbook)", "value": "fa23d89bf01c491760711826ad1744b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779947, "uuid": "6ee2fbf3-6cf8-469d-94e7-ce33634d7486", "comment": "Malware payload (Formbook)", "value": "ed2f68ce6d715976cfad3c41991685f1a190713626aea55c454da90682aa7ccb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779947, "uuid": "69cbf473-d9ed-4cad-8996-b691b4a039e6", "comment": "Malware payload (Formbook)", "value": "4802fec68f713b5707c4ea3385f5b1a800a18dd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779947, "uuid": "c7f82aa5-6f70-4ae7-bf23-0d695bfd123a", "comment": "Malware payload (Formbook)", "value": "cad1af36df8c5c57fa86d23486f7d730dab4a3aec07808af7d1065cfd7b65b20f37a3c40023e85b4d676be8cdcb81c5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779947, "uuid": "1d2e267f-07fe-4443-898c-874e7d37a983", "value": "T14EC4F1343A96D9A1E0592377C98E90880374B9057AA3E76F79DD334D6921BF33B016CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779947, "uuid": "e5ab12a3-8d57-4b6e-a41d-33d7358b5dbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779947, "uuid": "b38c871f-2eca-4adf-a7f6-142a497ff7c4", "value": "12288:OmWDNd1/JLqtXXLwPITpUza7J74Ic2D4BAExOgo6:s5qlMPI1Uz4cU4ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779947, "uuid": "f9cd3d83-42db-4ada-b75c-81beb5cb2b3b", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779947, "uuid": "2e674c2e-e347-4873-b9bb-8fb22afb684d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779947, "uuid": "226944de-d3e9-469d-b4d7-c1c315358cc2", "value": "fa23d89bf01c491760711826ad1744b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e7d1f9-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637772690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772690, "uuid": "521397a0-3d0e-44f8-a571-5f0e52a5455d", "comment": "Malware payload (Loki)", "value": "a65808e4d7d49d5ba310e19d62b27f98", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772690, "uuid": "55b4c224-eb31-45df-9b6a-0a29989b22b4", "comment": "Malware payload (Loki)", "value": "ed51a096d1b5235efcce914f6455a3271f5ca7a2a3c0613341dde2a27e58db2b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772690, "uuid": "0f57cbfb-2b70-4cdc-8abe-bfc58a8cec21", "comment": "Malware payload (Loki)", "value": "0f6592dcd418cb21726d68f16988b87f57780738", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772690, "uuid": "be5a959d-6007-4d87-97ae-268ffe47176b", "comment": "Malware payload (Loki)", "value": "e987fc79424870a81da3b4dee0eb9d84cfaae62e72598511022c62cf20d3f342cb5221a18047a46270e8eea3a41fcf12", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772690, "uuid": "2b380409-ef99-454c-9316-585671b0fa1b", "value": "T1D2341244717616B9F23C503327FAC9A29052FD286467E24396C23FBB893DA9D0DB1177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772690, "uuid": "6a078351-5af1-4004-b6d1-2a65da4eb3be", "value": "6144:hgI2CiTlzOUAPs85FyPc6YrMQNpFFXzp/Wb9a9KIx5t1:hqCiBzOU+sAFO3YYQNLGZcxn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772690, "uuid": "60d88b2d-e067-4b5a-adae-76796f342e54", "value": 234520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772690, "uuid": "ce07ca80-79d2-46c9-a700-7ac4e9d00096", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772690, "uuid": "543c3d90-5b33-4caf-9a72-7cecf63e6bbf", "value": "HK211116A.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded93b45-4d53-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637778315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778315, "uuid": "e24370af-4085-4635-9c95-a6f042ae99dc", "comment": "Malware payload (RaccoonStealer)", "value": "2c88778f7589de2ed06e9aaa05ed4d74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778315, "uuid": "0203bb29-6692-4444-8f83-5bfcbfa8f1b8", "comment": "Malware payload (RaccoonStealer)", "value": "ed9d17ee70ce16c077354f25f3c0161d52bf91ae83d48118a7902a48d88926d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778315, "uuid": "bd60c55c-717b-4d94-8f4a-5d331666861f", "comment": "Malware payload (RaccoonStealer)", "value": "44eeeb469c69e161b2647fa94c0620ee1fa01103", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637778315, "uuid": "a31ca453-7bbd-43e7-a378-bd5391bffc4c", "comment": "Malware payload (RaccoonStealer)", "value": "98af84084cc347854f218ffa9c9498d55ea706df346dd06d1acf6ed157923531c3cf675752fd12e05b09c555d1ac0b1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778315, "uuid": "8d79362b-6bb0-4fa6-8e7d-cd4144055fe5", "value": "T15DB4ED032DD8F718B4915D3382CF2E291B922DD68B7290466B59FEF512A02462D3BF7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778315, "uuid": "3c465630-1479-43b7-9440-8eccdd8c3e50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778315, "uuid": "84c9fe66-ba91-4564-8dec-bf30cebc36c2", "value": "6144:idPIbdk3CJWIOy1FIEln+58HDaJSNVews1TtVEjeNKuL2E3lS2e4cnJUYZ:6vEPLIEp+5NSuWFuLL30AcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637778315, "uuid": "1941d3ea-31d5-4393-b149-d89d9f61b0eb", "value": 534424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637778315, "uuid": "17ca46c1-8fd3-4127-9394-289c6fc591cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637778315, "uuid": "731ad581-8702-43f9-a3ec-d75d7e731ccc", "value": "2c88778f7589de2ed06e9aaa05ed4d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bc56f5-4d67-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637786642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786642, "uuid": "070906ce-0c1a-43d0-97ab-baec1a01672f", "comment": "Malware payload", "value": "cf346e278e8f2ee37d895d40a7d26511", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786642, "uuid": "98142647-a4f5-47a4-8025-e49d82209c00", "comment": "Malware payload", "value": "edd93ebe989113ce36f1d02759f2e617d73169557dcb84163db91e5a14f9c752", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786642, "uuid": "6b2655bb-a5f8-4182-83b9-f95ce698d54e", "comment": "Malware payload", "value": "11c188efe2b629f662dc475a86e00c3fa4751b89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786642, "uuid": "19af0f83-5503-4dc2-9f3b-a497bbac571e", "comment": "Malware payload", "value": "1c959f3ea1f15e3ce8e50c00ea55605cd14801aa67372af75e073349bac1f5b55c108c26984915c624e629e2886da7bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786642, "uuid": "2d8d24dc-1125-48ce-97d1-4674c9f39046", "value": "T123A4BE11F583C133D0AE1430297DD6A60AAD7D304FB499EFA7D45A3E4D742C2AB31A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786642, "uuid": "56a59bb3-c5be-4f23-8d18-d5499fc24a9e", "value": "c78edb9d5780b46eaa0956a2852d0a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786642, "uuid": "c617a5c6-1b11-408d-8760-b309379889c0", "value": "12288:kCy25dXCvOvAei/n8f5oueeyju1oN4uYLtyFYeOKNx2U:keAeikf5iee8ERcy6nKNx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637786642, "uuid": "222097e4-414e-4f97-89ef-31974e3f4aea", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637786642, "uuid": "e04600ce-f8e0-4913-85a2-d6c64f28d6d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786642, "uuid": "cc49954c-d23c-42d8-a37e-90c808e6aec7", "value": "emotet_exe_e5_edd93ebe989113ce36f1d02759f2e617d73169557dcb84163db91e5a14f9c752_2021-11-24__204356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae27d880-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637776086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776086, "uuid": "49517273-22f1-4984-adbf-41125f8dc6d7", "comment": "Malware payload (Formbook)", "value": "b59790e8431b3208ce4a8384d6ba9e28", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776086, "uuid": "8a3a4141-e0de-45f0-9447-ab1acaf5da02", "comment": "Malware payload (Formbook)", "value": "ee88a16a5e65133c9fc36dba55e31278b5d7b5d65e17ad01febd69afd8bf5729", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776086, "uuid": "3a02a52e-737d-470c-914b-96ed7295691c", "comment": "Malware payload (Formbook)", "value": "bac67327f88c388b1d079b5e0d425fa73b921d53", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776086, "uuid": "3684a9dd-d999-468e-8fff-74a67145c4ac", "comment": "Malware payload (Formbook)", "value": "5ebd4a4dde07a83eee43d0ce704408377e079b7da5ea029561b1dcad0db5412941fc740e7f83d4cea0053241796718f5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776086, "uuid": "af13f509-7852-4143-b983-c7a261aeb47b", "value": "T11A34128AA2A57144E1FA89BBACE156F9806FDE793145F44A18013C8C4F785A8D0BFD73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776086, "uuid": "c6f98857-34b7-43fc-bf61-74a67b4716eb", "value": "6144:u2IdGJvILP71fJAzYrWJfKwUnNNrDitYSM0:u2Is0lJaYrMKZnTrDVr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776086, "uuid": "8a190216-ba49-4b73-a659-abb112175390", "value": 234328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776086, "uuid": "f3e14d88-6b64-4f2b-858c-9a566b1497a0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776086, "uuid": "077e9c34-020c-4dfa-a46b-492a8b45a041", "value": "Payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b50b308-4d3f-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637769424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769424, "uuid": "0a38768b-50c2-4398-a48f-9265dcd08e69", "comment": "Malware payload (Dridex)", "value": "4b4e0da78d069ad63be8a2bd0756b7ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769424, "uuid": "bff7e691-0042-41dd-bb04-eae1480337e7", "comment": "Malware payload (Dridex)", "value": "efcaf7364573f2064721587d5ccfa6ceea6f89b1963c7f2e09ba20514431dcb7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769424, "uuid": "307196a3-a4d1-42e7-b46c-65ce1fbd3074", "comment": "Malware payload (Dridex)", "value": "10c7015406e5f80fc489ae1efdef99404aa5aacc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637769424, "uuid": "8f221938-1bff-4bff-b4cf-40542595e1a1", "comment": "Malware payload (Dridex)", "value": "d65d6ebcfb54468fb46678ea5649eeac1efba1239dd3b36ece3c26d43950e6420ea479654ced9f6c248b142c6955f04c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769424, "uuid": "7c387067-64f4-4361-8346-f73c6de71ff5", "value": "T1FD73025EDAD974E6C36CE43E834D08BA6D1AED26644487DB5CE4B81C02F0387B64D28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769424, "uuid": "1f5127e8-a023-478a-94f8-e2701c546ca3", "value": "1536:UWNPZZKz/1eCzbqzLkh/OPvTFVKintqzqfk/QPLXcUcXygdLl:VvEz/9qGWPvZVK+tqOfk/YcbCgdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637769424, "uuid": "d567eb2a-d703-41c0-96be-9a02cf3d00f0", "value": 74056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637769424, "uuid": "03002733-be96-4fc0-a5db-b91f1c3c927f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637769424, "uuid": "43b3f759-adf7-4404-bca4-642aac9f1cf2", "value": "tax77567960.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf5d433-4cfc-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637740839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740839, "uuid": "120262b2-a416-449c-aa2e-4d2fc308b741", "comment": "Malware payload (RaccoonStealer)", "value": "f9fd5468467d96a26e9002aee30c959b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740839, "uuid": "99dd45c0-a35a-4588-bba5-07ca7c4eacb1", "comment": "Malware payload (RaccoonStealer)", "value": "f06fa33d36606cf5a9dd11fe35348eb6a3e8871367ce40d9842dff39c584d186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740839, "uuid": "bd709fed-0818-4eb0-bb9a-bb1a40720a7d", "comment": "Malware payload (RaccoonStealer)", "value": "7e97fdea955f2ec9d9f6258db4d7c12036bc7671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637740839, "uuid": "bbf6f46e-251a-46b7-9d4a-26e273f8e399", "comment": "Malware payload (RaccoonStealer)", "value": "ef2bfa08afca6b7935bd749b68868ab5e148235a1de929956d3ad9dfcd3a2b6144757ad21cf815ac407d1e6cf7465b41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740839, "uuid": "9cf107e9-f3cc-450b-be53-a5de0395c75c", "value": "T129455A7BA386E011E6BA1FB5A2D34B5038B39C563262002AD6E03F48FD777B47D49764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740839, "uuid": "a05e8661-731f-4660-822d-664d0e7c1e0e", "value": "c154c4d1675c0aaecb90c316afa9fd68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740839, "uuid": "83902450-fb5f-4460-aac4-499a726c62ae", "value": "12288:RflAsjP4f1JUvZ2niXFnLCShS32s1vV9Ky940R8fXy5YleRLDXGuabZx389nDQqD:RfldAf1eZM2s1d9KW88XaiQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637740839, "uuid": "d54a841c-9f0c-4d64-8785-366476c368c1", "value": 1275904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637740839, "uuid": "08a35aa2-b530-48b1-902e-1d3ac29d3d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637740839, "uuid": "dcd84e41-0bdd-45c3-9dfd-50c65b7ebfc7", "value": "F06FA33D36606CF5A9DD11FE35348EB6A3E8871367CE4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976a68ff-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637776048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776048, "uuid": "a87362f2-a0bb-489c-8b70-5f8458e62e6e", "comment": "Malware payload (AgentTesla)", "value": "4979f54d935104d186511dd7e2946f87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776048, "uuid": "36e293d9-f06e-4f25-9303-5d1afb24c142", "comment": "Malware payload (AgentTesla)", "value": "f11a5546d344d109ac7406efebc72b8e2ca5a134443fd2fb32b690b2e384f148", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776048, "uuid": "efea4c07-0a95-47ef-a220-c3f0d28d5946", "comment": "Malware payload (AgentTesla)", "value": "fca9b1f312a68d86c95eda6486af603a0758123b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776048, "uuid": "73d7ecc4-9201-4e65-a7b4-05722fe78b81", "comment": "Malware payload (AgentTesla)", "value": "2074b064743951298f2dd7e8641f9aa6ef2e355b66c85c19abb55f57dfeba8862b1a0b61421799101a3285d627a7e867", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776048, "uuid": "11e670df-f884-4183-90c8-73ab570ed339", "value": "T172341229F251C7B8FB6F837D4AA17219D734EDB2E553119E8208706E49F8CD6C221A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776048, "uuid": "c537b991-0ba5-4596-bdb1-215916452da5", "value": "6144:/0R8x88LSsnv2tksMoOxlfm9zP1rkh9oU614z4iFUWPFoVB0QNnC:8R08Fks0PcL1woUgWFUuyVB0QJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776048, "uuid": "9490f1f7-f174-444a-9151-036aa6e593b5", "value": 234456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776048, "uuid": "5fc077f9-0e52-45e3-91e1-ab2500ca0a3d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776048, "uuid": "668ddb8d-d38d-4c2a-93c9-ca82cd08ab31", "value": "20211118 CIRCULAR ANULACION CUENTA BANCARIA BANKIA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5276473-4d03-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637743966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743966, "uuid": "7954f9b8-7586-406c-af81-101e9b1a3eca", "comment": "Malware payload (Formbook)", "value": "885f06b6bb838baeced3dc0e0a62e864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743966, "uuid": "7e4ac27a-0123-43b2-bc91-08c45c325557", "comment": "Malware payload (Formbook)", "value": "f152f218360c8492207cdbfb60824e7d55737adfdcc67189f890c61ff2617af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743966, "uuid": "4ec5a2ab-5f25-4578-8f66-4cdb65135d02", "comment": "Malware payload (Formbook)", "value": "74dc71237271e2afc324ed7727f1819b7f903c43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637743966, "uuid": "05d46eb7-2365-4a25-8a8f-642d0c649784", "comment": "Malware payload (Formbook)", "value": "166c85749314f8d4f70b0de834d7d6f38e021ac3cfabb94b57800602431f32589ec36e3eaa4f9b72abc2909ce9a6ba4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743966, "uuid": "ebb104f3-7cd1-4262-b080-617d56e351fc", "value": "T12864232A65C7E6EBE6D00530137177B2BBF609BC412D8D0FFF36EE59281245C8A5C1A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743966, "uuid": "322f56b4-b0f9-4b0b-a5b0-f58d773d30ca", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743966, "uuid": "8d8ca700-d075-4bce-962f-391ac1de6e11", "value": "6144:rGiWpFGlXxXjAJOoy9xWJ73e610aMR3ySOfJ44onDqxwhKJ:apFGlXZu0yld0asySOxEqxLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637743966, "uuid": "bfc54cdc-a2e7-4215-88e0-2c84b7acf5b3", "value": 318556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637743966, "uuid": "3f8c1e9c-2e85-45ee-9bdc-ef4dfa2d8c13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637743966, "uuid": "3bb21197-0669-41c2-8cae-e8e0ee5d3dbf", "value": "VSL_MV HANNOR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed1a7e4-4d2d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637761860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761860, "uuid": "6c5bc194-8531-4a1d-9585-a47d0226745a", "comment": "Malware payload", "value": "1bd70e93f8513abadacf9be585c6c1a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761860, "uuid": "1b4572d2-57eb-4fb7-aded-c65552a23570", "comment": "Malware payload", "value": "f18086762470cf6fe6d61c2e931a71885ab007d83c81a3b37b46c39c5a4f4d6c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761860, "uuid": "f44af5c8-e928-4e44-bf74-e47adc1d93d1", "comment": "Malware payload", "value": "9147bb1132506891a145a5d4b75e50ab50503752", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637761860, "uuid": "6538c63d-7967-439d-95c2-8905e6426104", "comment": "Malware payload", "value": "e32aee09bbac0bb45e07789527a5eae1a27f52340cac0e758bc76cb14c6256cc19a7c67647833358a1636765397284c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761860, "uuid": "919e1d04-e096-48ea-8c4d-af7d4de0ade3", "value": "T15325D01C51AE12F2D2A7F5F0CDD0AEB3BA751FA20144EA15C14F21444C5A9EEBF6AF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761860, "uuid": "a09aa840-d18f-4f94-94eb-1843d5d4e22e", "value": "a316ed8f7fe3fddf491edef0ab4f3463", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761860, "uuid": "6725b978-91d5-4314-a7c7-b8a50c9fee4f", "value": "12288:NYqVT6T5InrZiVKHLLaXTX1iRKsVKqd8pEdJ0/UInueT:NYqZ6eViUHLmX1iT8OJ0/RueT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637761860, "uuid": "45137f47-086d-45ae-a436-a79df8113832", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637761860, "uuid": "2a0ee746-fe6a-48d2-bc84-6088d8cf4a8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637761860, "uuid": "9346c207-f79d-4263-90a0-484a9612dc7e", "value": "9147bb1132506891a145a5d4b75e50ab50503752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a73da3e-4d20-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637756162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756162, "uuid": "ccd2e708-3a73-41fb-8ede-793c670a0d6b", "comment": "Malware payload", "value": "1a0eb064e5ce3f0f888ea48aadd7c6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756162, "uuid": "fdb3810c-c2cf-4b71-95a0-bed0704ecbc4", "comment": "Malware payload", "value": "f1df707bab0fc04a78d1131d2739f54c351073d1dac04ea700573368feb5d18a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756162, "uuid": "a02a37fa-7deb-4b74-8ab3-b3a2cc502df9", "comment": "Malware payload", "value": "487a3a3e17b659d143dc48fb81d9c1860f2599e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637756162, "uuid": "2784f2a2-5f58-4945-bcd1-bb626cfe4f1e", "comment": "Malware payload", "value": "2987ec6e10a5cab1d38e6a6af40e87f8b38c9ff119e99b581d5d6c1157a74835e58c0d6f471f78bd3c81fdaf1949e4ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756162, "uuid": "47f4af36-f3bb-4bdc-95ab-a32354797573", "value": "T1FA94F11035E5E282C9770FB64D7120804272E2556E12DFCF6CC4578D6DA7FEA8722BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756162, "uuid": "9cbfe44e-b2fa-48cf-993a-2ce3e848d800", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756162, "uuid": "2b338519-47bd-40a7-b4d7-260d3d299d5f", "value": "12288:CPMoogAgkXrw5xRI0FLa37O74Scp8rjG4Bgp/:CPFkXrwnRIW4OsSc8/LBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637756162, "uuid": "86e60788-6f30-4f92-8669-260c5be6f9bc", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637756162, "uuid": "724afbe1-e341-4d01-af21-0940e09f4b13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637756162, "uuid": "e11f137e-13f4-4b68-b6ac-622093adbf02", "value": "doc201002124110300200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdec0759-4d12-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637750450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750450, "uuid": "40d97e26-33f0-4572-aa5e-202ca9a8b757", "comment": "Malware payload (RemcosRAT)", "value": "7894a9126f6084d084bacdd3f0188fa9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750450, "uuid": "87ea5d90-4312-4a17-b135-0f836ebc0ac4", "comment": "Malware payload (RemcosRAT)", "value": "f1fb2d3fb211b9fab233ce928c58a28d5fadd81d694b0d700698d82020620f81", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750450, "uuid": "dc9eb7c8-fdaf-4e14-aa3c-234c286fffa0", "comment": "Malware payload (RemcosRAT)", "value": "2f5e2795c7b1f3d6deb681e0b4d528b656d04917", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637750450, "uuid": "4aa2795d-9f97-4519-967c-71fd138ae359", "comment": "Malware payload (RemcosRAT)", "value": "d67f4f0f4e889251f952cde3dec3b1bb5d200460e0be2e009f437b35ca008800bc5d534a54c9cde4852054bbaeabc41c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750450, "uuid": "6e3d9731-40b7-4598-9965-9cf788a5187a", "value": "T1F8E433D038D36EB443C04C5FD258469EAAF568337C0932FBE915487E942E9E5CC5F2AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750450, "uuid": "8201de95-0b73-4314-bd16-e668f556059c", "value": "12288:5r+HYuiZ+RZgIj6K0o8SMq6WT0X98j0BQq0CIDDD1gClfTay2kH:J+HIInFuLo8bq6K0N8j0BMCud1lWyfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637750450, "uuid": "69b39510-e4c4-4d02-8797-5fbe7f6909d9", "value": 680253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637750450, "uuid": "6e81cc55-cb78-439b-9e8b-7a9c7a0da6a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637750450, "uuid": "2f03558f-b478-4d04-a4b1-5bcb773eca5b", "value": "VAT Certificate.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c56146-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637776010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776010, "uuid": "feb43dec-0913-48a7-b3ce-0582c32e05cd", "comment": "Malware payload (Formbook)", "value": "514cb7db4256805b03c576d90ebf10ea", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776010, "uuid": "699d8182-c7d3-4270-93cd-1a7e5ab3d91e", "comment": "Malware payload (Formbook)", "value": "f25a79f4767d6469e49d59fa050da7ecc7da6e2603ef1645b9ce1758960cb910", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776010, "uuid": "ed7135a8-42ca-475f-8eab-dde125b10cb1", "comment": "Malware payload (Formbook)", "value": "9e323bdcb5a227b0db11ab49972ec6e525a04a41", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776010, "uuid": "7c01130b-243d-497e-a33f-f966cc70696c", "comment": "Malware payload (Formbook)", "value": "4aaedece758cec56bc8f4ad3bcd726956100666b38f99417de15161e3da2bb891226e91d548abfb555a3ae533a8bba93", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776010, "uuid": "6590ff00-f63d-4120-8c3d-636a1f1bc909", "value": "T13434221336906CD4DF6007F0952BE795DBFCEDB88502A42BE0B439AE0577FBA589CA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776010, "uuid": "7f93592f-b851-4fcf-9fe4-cdb288c1bb0c", "value": "6144:r4KNve0uhmBEap4l+1LO30B/YkhGrK9W+DuwDXkAKaW+K4UC:0uFuhmp2+LOg6TIjkABW+K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776010, "uuid": "3e5f106c-9013-4c15-9f62-5f2f76beb503", "value": 234488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776010, "uuid": "28a098a8-b5a7-45ec-96a6-891660787027", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776010, "uuid": "f2119396-77c6-421d-8c49-aba5bca98234", "value": "MT103_RECEIPT241121.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb1f4a9-4d4e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637776030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776030, "uuid": "8b06b296-f65a-4217-b8bc-945201fa9a84", "comment": "Malware payload (AgentTesla)", "value": "759ea56ea7256849bb7a016dd58e247b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776030, "uuid": "d2589d17-e166-4436-9954-d2c5047bb968", "comment": "Malware payload (AgentTesla)", "value": "f3218faa984689412ee7912487dd799afafa83d51eb4c256124f185f9889b86a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776030, "uuid": "c001fc91-2987-4369-9992-3bfc16e8bf93", "comment": "Malware payload (AgentTesla)", "value": "d8a8f6e7f13b9c9b1fffe211089b463f28eb55b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637776030, "uuid": "a82452be-49f7-4c68-ab4d-d75edbd4ba61", "comment": "Malware payload (AgentTesla)", "value": "8ac620fadb9f91c33bcf7a86f371016fde3e5f7210b6eff2562fe453b93df5cb082541644432b2a2f36fb50a998f3948", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776030, "uuid": "5f219157-b54c-48df-b61d-b67d5b05df80", "value": "T17434128475A06DC4EB5A73781410BAB86FCEEC1D1E556F7E9C8E3110997FC44E42AB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776030, "uuid": "3e91fa82-ae2b-4828-8676-9a6a5936d3a4", "value": "6144:1Duxk5nlhRt46kP/X/yGf4NgYFChUTYpvqmfEvz6XnVhPN:1PfRK6k3KQDiT4vqm8vzonVhPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637776030, "uuid": "48fea82b-0100-45eb-924d-a14de79756a4", "value": 234264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637776030, "uuid": "355456f6-b883-4da9-ad9e-cecf8e74b727", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637776030, "uuid": "14735a75-4b41-451b-af78-6953eb80c217", "value": "4777_211122173928_001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db89a74e-4d55-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637779169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779169, "uuid": "ed57ae15-fb61-4519-a82a-8f543d917fb6", "comment": "Malware payload", "value": "09993b8c43100c2a84eb75f9def3de12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779169, "uuid": "1bf2e46b-0f89-40de-8a7b-2568948559e4", "comment": "Malware payload", "value": "f325e082eec367b50da21082c80def6eb63525d6208cbdb83fdc639a504f558d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779169, "uuid": "a111a0dd-2de4-4f77-97fe-a293c6cfddaf", "comment": "Malware payload", "value": "d119cd94348769e9a52836171f147e3cca851692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637779169, "uuid": "bdb43357-36b8-48a5-bc17-fc63a5bf2596", "comment": "Malware payload", "value": "3fd71473dcd8583cefc2993f9b02d06dbaf60a6e7f37756ea0371702e2feb7cc58cac9bf40ad7e01c26a29f6d085fba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779169, "uuid": "e5797c08-09ad-483d-a379-c1bd08675ef6", "value": "T17524B023359EE941C40A4B315F37A527EA186D687D30F6CD2587F6AA4BF1EC37012B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779169, "uuid": "ba6287ec-4fd9-46b1-9599-c785fb641b4a", "value": "1536:Ubxx0WN1B7VSv9xR4gycgVSFH6ts7FSxYDYY/BH4GeJvL+y4StP:xq1B7VSjGbVIHSxYDYY9eJKVS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637779169, "uuid": "014f6dff-16e6-4650-b55f-c593b32daef9", "value": 219755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637779169, "uuid": "270800bd-5218-41de-a262-76204177378e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637779169, "uuid": "540b272b-fabb-4cb8-9e0e-29d3ed1a21ac", "value": "09993b8c43100c2a84eb75f9def3de12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f023c4-4cba-11ec-843c-42010a9c0014", "comment": "Malware payload (Meterpreter)", "timestamp": 1637712235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637712235, "uuid": "679b3766-9ac0-4cda-a844-d9ec5db246ec", "comment": "Malware payload (Meterpreter)", "value": "82070c9a851141413eed917de23dc7ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637712235, "uuid": "81a6fd55-51cc-4da8-a9f8-f1caedc10e4a", "comment": "Malware payload (Meterpreter)", "value": "f32b8b0530ed068b47817d165064e99800a44a943ccae0e32f6b6b3e40c79638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637712235, "uuid": "3b276d55-8420-4142-ac16-2932457e88b9", "comment": "Malware payload (Meterpreter)", "value": "1a47d53eee991ffc3d09f5df8d902bf0a2c5fafa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637712235, "uuid": "25b2751b-4287-4220-9031-68fdad2ac6ea", "comment": "Malware payload (Meterpreter)", "value": "d4fa34e762b80a2ef6c9248aaf476ffa2134a8e72001a53042466a2d2e9a3847d58f0cbb096455cef0e8979b97d08bf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637712235, "uuid": "140c8484-6869-4b29-a973-327c270a0cda", "value": "T1E042296EBA0115EAD57F84BDD9EE0E06C772B0232631A32F5BB581491F73392321E306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637712235, "uuid": "a9202748-6873-47e3-a5e3-03f9c7556a8d", "value": "a81feb71459e55348b1be04fe5d45f01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637712235, "uuid": "e1ba2c9a-d873-407e-b5b9-15820e02e86e", "value": "192:8BDqNLRktHLh7fEHQnL8ooIZJsvwYMD06DmVSQMn7nI2zXTQfRM0:8vHLh7fEwnL8a7FA6KSQOnI2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637712235, "uuid": "0fb8cb79-f075-467d-8ae0-bbecdf64dfa2", "value": 12720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637712235, "uuid": "3baa45c1-f43c-4b1d-9f09-86bca55af21d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637712235, "uuid": "52949c9c-e4f4-4cca-97fb-4a82329fe095", "value": "diceloader.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae24de02-4d2f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637762772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762772, "uuid": "f5fc2e4e-7427-4d19-ba71-e7911b19bf5a", "comment": "Malware payload (AgentTesla)", "value": "0008b6db72e39140e8c41e08d9ce8fd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762772, "uuid": "4d2e4204-6558-4bc5-be95-163143b9a2a8", "comment": "Malware payload (AgentTesla)", "value": "f39ce3eb0c7669d8ce2ea35f356ae3727a87c41d222332891809aa3835ab8208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762772, "uuid": "344af09a-bf83-42a3-b669-d65c5fd2144a", "comment": "Malware payload (AgentTesla)", "value": "85450c1d674f87bf24dfd55342f9a41b6a3a8ed7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637762772, "uuid": "7113dd73-619a-4f92-b548-4ccb220bac6e", "comment": "Malware payload (AgentTesla)", "value": "1edcb73fbe7903eaee67c2428674f7254ad24fe876a21367afd20b4b52a2793d57699de09a2745ed13a17a93425656e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762772, "uuid": "0fba90da-14a1-42e3-b45f-374a88e8c4b2", "value": "T191C4E1A8379072DFC827DE718D645CA0A73170675B0BC71BA047229DA91DAA7CF216F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762772, "uuid": "90f63a60-b5d3-46ae-98ee-8f5f91d71282", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762772, "uuid": "64021ac5-e5df-491f-83b0-6d1b4eab94f0", "value": "12288:Xu/RQWSIQbTanam+ptjjjXe1NYMtD00d4b:e/RQWx4aanj21NYMC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637762772, "uuid": "e4e361c1-dbf8-4649-b096-2c54efafd50d", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637762772, "uuid": "a8f3e671-cc43-4e53-804e-d967f2c902ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637762772, "uuid": "1804f0b5-fa93-492b-875a-68a063a10d01", "value": "microcomputer Official Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2743087-4d4d-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637775664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775664, "uuid": "e0e4ca21-31c2-47d3-8008-f5556ce4c21a", "comment": "Malware payload (AveMariaRAT)", "value": "38c1b028d3bfb2cddd0945292732198f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775664, "uuid": "f3707464-f1aa-430f-9ed4-3189f1761ce8", "comment": "Malware payload (AveMariaRAT)", "value": "f3d6269000447f5f74cd273abd594ce3ec8a6b7401a002bb8929a099154da19c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775664, "uuid": "33855b24-148b-4aca-a398-d113c7c6f52a", "comment": "Malware payload (AveMariaRAT)", "value": "f5584e4cd455a5da9a90609fb588871fc35c2996", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637775664, "uuid": "0b29fd3b-c06f-4b13-a833-d9da7699d86b", "comment": "Malware payload (AveMariaRAT)", "value": "7cbfdb599a04b55d886261266d4f2de947860f0f720e46b4178d52e22157bd94007496116c2ec0fd28da525fcbde954b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775664, "uuid": "015bace5-3b43-46c7-bcc9-236b05ed98fa", "value": "T19B62DBBCC19B06988F856BB82B0B5F85118C366DF784A172327C577523D2C7B911797C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775664, "uuid": "80610724-d915-4cad-b93c-c20585b81249", "value": "192:UnyfSdab9I195b1/YLiF/YLwl9kQVk0+8q5rwT2yAA:AyqQbw95NYUYLsLVk0+J5rS2yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637775664, "uuid": "cc118f62-b22f-43ef-92dc-2444503ef333", "value": 14679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637775664, "uuid": "17527bc6-a4ad-40f9-aad8-90b030798b04", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637775664, "uuid": "960c74ef-fb1c-4eaf-9216-d9bc1a9ac3f9", "value": "PO 36457967.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f13c04f-4d6a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637787953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787953, "uuid": "a42d0639-3de8-4634-b39b-112ceca6eb5f", "comment": "Malware payload (Formbook)", "value": "596b608654b92e1ecfca12ea2a61d3c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787953, "uuid": "10513f87-39ff-4054-b355-a73769a78460", "comment": "Malware payload (Formbook)", "value": "f4ba4c7cfa06963a05eb720c098686c8296e799fcfe96c7f44ae1b9ef814c1da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787953, "uuid": "ff7dc820-8bd9-492b-9868-81be90072ea8", "comment": "Malware payload (Formbook)", "value": "7e1bb15a8a13108bfdae90280b1a47aa46f0a181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637787953, "uuid": "e05128d5-4ffc-4bef-90b2-1e490ec9b38c", "comment": "Malware payload (Formbook)", "value": "10babcd57f03791c94944470b8c1f65111864a552de2ed8918183a3ae0d4431a1b330df9a0044b77e7381c8b58fff086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787953, "uuid": "c40be1d5-650b-4a1b-a10e-9955f05dd52b", "value": "T10CA47B5CB6624A9EDCD21470293F699043253D22777EA4F2732AFA9EF520C1DBC462F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787953, "uuid": "acd76719-5951-437f-bf70-0ebfc67a74d8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787953, "uuid": "03cc2020-3920-426d-bfcb-b040a769be77", "value": "12288:uA7BIeNsNZkNFJPO6Ya88hxT21TDZ03N3:uSgaXIa88zT2d1ON3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637787953, "uuid": "082a10c4-ac9f-4736-96e6-8f3e2e58a288", "value": 489421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637787953, "uuid": "fa09ee78-d555-4cff-bccb-69a6c6522f93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637787953, "uuid": "ba45ff7f-41e8-424b-9191-8b25abc73cb9", "value": "SecuriteInfo.com.Trojan.Siggen15.51910.26071.7063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f7b029-4cff-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637742117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742117, "uuid": "07efd814-b485-45c8-b06d-bfbec25690e4", "comment": "Malware payload (ArkeiStealer)", "value": "95eeb9a5973bc5af2860a16f93d6cead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742117, "uuid": "06755bb5-563f-4e57-8179-c98da9e067e7", "comment": "Malware payload (ArkeiStealer)", "value": "f5d10e74933e4cb46f933172a02ca91f41635f8b7bb5c3467b1cf5870de46c22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742117, "uuid": "1541adb9-fb44-4bd7-a962-a77065e5388a", "comment": "Malware payload (ArkeiStealer)", "value": "3a3bc97dd1ab1cc8c9484421a2eba057ceeab378", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637742117, "uuid": "35cb1e26-d761-46e8-8cd8-be3e907cd147", "comment": "Malware payload (ArkeiStealer)", "value": "b1572a800baa68f7c62df1b9b14249f60da07822548ca9553bc3a07927080e487c586142abe09752d58fa2e691c608b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742117, "uuid": "356bb55a-6b07-4c83-a257-8dc915e7aad6", "value": "T138552832AD8CC83EC96AD538480A925B48F77D70293FDD0E19F48F4C4AB726DEB95152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742117, "uuid": "47819d48-3893-4a81-a003-7220d5524492", "value": "51bdd5c24a2d998f177313ae325d417a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742117, "uuid": "5d990762-c06d-4221-9434-d712a22eb529", "value": "12288:JN7qAaluiiivQxUVi9MpvAw642f/2KvWu17u:DOFuofI8K/r+I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637742117, "uuid": "e6d34e92-5c89-41b6-bf33-1053687d8d6b", "value": 1288704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637742117, "uuid": "63539a69-a80d-45fc-9e8d-4cd24c8cb4fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637742117, "uuid": "78459cc2-8119-4a95-ab3a-72b3dc2bbe63", "value": "95eeb9a5973bc5af2860a16f93d6cead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f172d8e-4d67-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637786637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786637, "uuid": "f413f503-dcd5-49ef-aed0-008abf3caf3d", "comment": "Malware payload", "value": "445a8d7cbffc76929a24a5971511b2f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786637, "uuid": "ee9bb3e5-9d84-491b-b415-42bc78cae63a", "comment": "Malware payload", "value": "f94a0020c6d039a0d9a531def8b152ee5a9500fd300259ba26cc935b3bedebe0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786637, "uuid": "2fa28012-b1e4-4bed-9620-c0a02958f359", "comment": "Malware payload", "value": "4db62aeffc991dbfe343bcc39e7081ff82ad1515", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637786637, "uuid": "0e4be5b6-cb0e-4e42-b2dc-1257aeae451f", "comment": "Malware payload", "value": "e72a7374e57ebb0ebacf54632dbd38bcb1ae3fc327a8bef284bfe0f1084a3b514ef000b43ef7116e74d933f09fd18e43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786637, "uuid": "ee04de3e-f0ff-43c5-9c94-143ede024d10", "value": "T1C2A4BE11F583C133D0AE1430297DD6A60AAD7D304FB499EFA7D45A3E4D742C2AB31A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786637, "uuid": "dc5420ac-d46c-48a8-9986-48edbf96d1ee", "value": "c78edb9d5780b46eaa0956a2852d0a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786637, "uuid": "00246c30-09ea-4fd1-be4a-1ba632b06325", "value": "12288:kCy25dXCvOvAei/n8fioueeyju1oN4uYLtyFYeOKNx2U:keAeikfiiee8ERcy6nKNx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637786637, "uuid": "1569b58a-b40e-4917-abef-2dc38db2c200", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637786637, "uuid": "39ed1ea3-7e3b-4372-8200-2da1adcdcccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637786637, "uuid": "d53b4a82-83ac-4da0-ae37-c0bcca3d6f54", "value": "emotet_exe_e5_f94a0020c6d039a0d9a531def8b152ee5a9500fd300259ba26cc935b3bedebe0_2021-11-24__204353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d88588-4d46-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637772524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772524, "uuid": "925c98db-7a92-4d5e-a73d-f257c4acf22c", "comment": "Malware payload (Dridex)", "value": "76c9558a0cd42098b2c6e72f2264c1b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772524, "uuid": "a2707df1-7a6e-4ad0-b0d9-77066ec15f2a", "comment": "Malware payload (Dridex)", "value": "fad0cecec2b7f448148ea2be04e59637b2439580d9c58d2d59c5bd44af33b4dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772524, "uuid": "1db826e2-0653-4627-afe5-ba3eb88676eb", "comment": "Malware payload (Dridex)", "value": "5ca8c80ee1d74e3800a1832c3c68790850262e3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637772524, "uuid": "c547e115-c111-4ea1-8710-45a58fde593b", "comment": "Malware payload (Dridex)", "value": "ee21dc11b385722abcd2c3a2081800faa967ac72e169577cfb2ad67ffa0d123c8a200f3378f429f4abb4dbc0d43dfce7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772524, "uuid": "96d03d31-4d4e-480f-82de-4aec35498250", "value": "T117F49F04160C81F2D13EB8F99FEDF291CA3A6F446169D3F8B65662C170C76E5221E78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772524, "uuid": "893019ec-7cf1-4407-9be0-a3a170f39fde", "value": "d179952d1193e1cd0ba3af2a8e8a650b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772524, "uuid": "4062e787-5d99-4ca4-bebb-c77c2477f6a6", "value": "12288:x/g8A8wcY0yUcQkQUW0QAa0SSMuCAe2UiaUWQIqGQmy0ymkxceCalbcyZ8fiYBiw:RucRalbcymf1BFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637772524, "uuid": "cfc238c5-acb1-4e5f-b384-4fb0e5634a51", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637772524, "uuid": "68d811f3-3bba-41f8-a662-d81d5ca1007b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637772524, "uuid": "32558a57-d510-4caa-87a3-701d12cf230c", "value": "SecuriteInfo.com.Drixed-FJX76C9558A0CD4.8758.9432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ded89f-4d4a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637774195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774195, "uuid": "2e15a236-82e1-4da7-9753-665a1ad7d32d", "comment": "Malware payload (RedLineStealer)", "value": "7bd0607e809bbed2f1294a4bf3e91fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774195, "uuid": "3dd60f75-3907-44d3-b075-4aa04b56cfb9", "comment": "Malware payload (RedLineStealer)", "value": "faef6881477bcddcdc4ef70525e388445bb385c558ee5ed08447488527be0de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774195, "uuid": "af3c9c63-0566-49fc-90f6-fd14026170dd", "comment": "Malware payload (RedLineStealer)", "value": "47aa791d7082940eba2754f2302ad7bc5b85573a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637774195, "uuid": "df7ee2b8-f54f-4598-a10f-b5e492e2b5c7", "comment": "Malware payload (RedLineStealer)", "value": "fe1d339c8758b7a8d6d7a5f46292c8bb61a14fe7eed7d007c95669b9b0e0c1fa58508fb29003de4db9d5e9352aba91aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774195, "uuid": "d7013656-68a2-4bdc-a244-b752c3e26d25", "value": "T1C594BF10ABA0D034F5B716F899B5D3B5AA3F7EE16B2891CB53C12AEA56346D0DC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774195, "uuid": "3495ce84-6ad0-4afd-97f7-e04376ae1bdc", "value": "227bb68f00c01d84de5b7cf57cce44af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774195, "uuid": "96665ede-8a2a-4355-a061-aead5b271bfe", "value": "12288:jflFPptF6LnvPO27dawfY0Zn3ENvRfh+aNL2z:jflFPjFEvm2tfJ24awz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637774195, "uuid": "34d99499-7c3a-4cb8-a9ea-56eb2aa0d20e", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637774195, "uuid": "e8252c00-5e78-48b5-96ec-48f072bc408a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637774195, "uuid": "420e415c-c100-4e60-a9f7-5111fc60c16a", "value": "7bd0607e809bbed2f1294a4bf3e91fe4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f0b6f9-4d35-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637765231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765231, "uuid": "4407ce52-f586-42ca-b196-d64ab7aff3d3", "comment": "Malware payload (Dridex)", "value": "52c9f18e4eccadf0458490b247a0d7ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765231, "uuid": "7b6765cb-607a-4f08-bca4-a0932bc0de51", "comment": "Malware payload (Dridex)", "value": "fbcc68a6ca33d19948cba36ff5be64fb9d2c4258dc714a8223f37623acf6b5d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765231, "uuid": "cca2ee18-eb72-42dc-b260-4d64e2190ec7", "comment": "Malware payload (Dridex)", "value": "410831f8e8d68a6742d76236741edfe00f9a9854", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637765231, "uuid": "5ba9186e-e484-45ab-8cf0-1bdd76180b5d", "comment": "Malware payload (Dridex)", "value": "e4664ad310167634069fc4dfc1790d68557a78fc09dba1a15cc41d9f361276541503a2aab662b98bbbf6ba9e20caa699", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765231, "uuid": "ff160fc4-c02f-48e2-9367-c1080bc2bf09", "value": "T1B663F2AEC544F118CB52CABFCB7B08F5A20B0D536A59909B1899B7047FA33438FED119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765231, "uuid": "2e993595-ee24-4ef6-bd12-225dc6b7d037", "value": "1536:UWfPuALLImemeKHqeK7YncNiJS+YkyHHvqovz/6/ugdN3:VO80XKUYeB+YVvbLOugdN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637765231, "uuid": "0c9e8e0b-82b9-4b92-b76c-a91e99941048", "value": 70005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637765231, "uuid": "e8da37cc-89f0-4f27-a7ac-4ec278adf977", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637765231, "uuid": "09203115-e334-4bf1-ba12-21f38cbfb5dd", "value": "Netflix-54850.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c6f26f-4d05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637744471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744471, "uuid": "1bd77705-a725-4b09-8dbf-9dbfd9e31aa4", "comment": "Malware payload", "value": "1ddab57687fa96514c941a3ca20edfe7", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744471, "uuid": "0b757710-1a7e-427f-b87c-1c501ddfced4", "comment": "Malware payload", "value": "fc40413f0e90c57e43b5664395682d9c5bb913fb97dd753ed41f4e3668902517", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744471, "uuid": "db82d842-04e2-4486-a96f-b99a7138f384", "comment": "Malware payload", "value": "da2e2c622f9e7b3a97d9a95f3304363ca14c3279", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637744471, "uuid": "c00773a5-bedc-478c-8465-a41ac29b560f", "comment": "Malware payload", "value": "47e820daf9bfbd7d304b6cedf508e2e4b5b2bf47d36cf00b4a0bac86e877f5ecca2f30b3298c6009f8f9c574af601257", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744471, "uuid": "60072ca8-dac7-42ac-8a79-1a9edea63e67", "value": "T1B2B5330C137ABCFDF85E41293B634EE0C5B9A1E1F5426092D26848A85C3F5BD13EF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744471, "uuid": "18434d93-d9d1-4914-9b4c-fc79e69b2fd5", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25Lfprc1:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637744471, "uuid": "94da4d89-2574-42e8-b4e0-9d8d5d74dc12", "value": 2392064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637744471, "uuid": "01b9c6d9-1f58-49ab-801f-d40e58046f79", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637744471, "uuid": "a2f4d455-7619-48e2-a9af-681a8f0dcfcf", "value": "fc40413f0e90c57e43b5664395682d9c5bb913fb97dd753ed41f4e3668902517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fc94f0-4d15-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637751589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751589, "uuid": "01c6d783-2b26-4d0d-a661-26e80dcff845", "comment": "Malware payload (NanoCore)", "value": "e40c85fb0613efb7c73b93d51a72cda5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751589, "uuid": "0eb75246-0746-4ccf-ace8-69c9d721bf3c", "comment": "Malware payload (NanoCore)", "value": "fc738d6f2c037f7fa3f40e362d99013664e4e0fc2ef54d61e1d2c4156e07ad50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751589, "uuid": "f6e04bb7-e71b-4648-aea2-2237a3f7a11f", "comment": "Malware payload (NanoCore)", "value": "8db384a16df0c904d09e11577640b422355983d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637751589, "uuid": "61f91787-1f10-46db-a19d-1434286e2684", "comment": "Malware payload (NanoCore)", "value": "07131be279639b4fcab579879c448934170049dfa75a2cbd47e123c9265e0fb0a4144e5133e334dfde5e8fb5263840eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751589, "uuid": "edc5d29b-f45d-4ab7-9f7d-8aacefb46e44", "value": "T122356B1523BA2F64F03E97386466858857F6F903A336DBAB3FF401D90262F45876271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751589, "uuid": "6e932939-cff2-49c0-89a1-02ca7f3b50f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751589, "uuid": "9ab81709-384a-4ba4-ab18-f106acda400d", "value": "12288:uDLWVcmr41PK2mRXkslajk12xOnAIrhM5ppEaMelos8UiSw7hytiZOaVXZL:KLMKifUoYk0QAKsptMesGuhjxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637751589, "uuid": "3cbaae29-85bf-4bcb-aa7d-3cabfc45234a", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637751589, "uuid": "03a147cb-dae6-468f-a400-a782d722d248", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637751589, "uuid": "f4fcf5e8-8500-44c4-b7a9-22d0dfe58a6c", "value": "versions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d431554-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637782312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782312, "uuid": "1cbd76d2-d69c-4e0f-9d95-b82847e03b9a", "comment": "Malware payload", "value": "4e389aa1cde25a1b0e981a5c7d4b54b6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782312, "uuid": "a20ddaaa-a46e-48d7-9467-687b001b6773", "comment": "Malware payload", "value": "fda3acb31ea117aeae632a6f876fdd1c4f5598a8cdd4ed39410721419043d0d1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782312, "uuid": "ba399dcf-0e62-4682-8c0c-f998896d856e", "comment": "Malware payload", "value": "ab4036138c8760b32036c821627299b3084427fe", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782312, "uuid": "136eae2a-657a-4d7d-9c8f-093bd04f1958", "comment": "Malware payload", "value": "a4753e978ea199c5efdd0a27b061e471975717121168de3bcf5588605bd4bbd9f1a5eef38a8ae3ca366bcfe9dbd2afee", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782312, "uuid": "85e65134-c903-4f92-8e45-6a1fc465d806", "value": "T1F305CF157BDE2661E85602B32B4A8312DF75F8204F11823E728E5D292FE5574E7B32F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782312, "uuid": "323466e9-daba-4ee5-a576-7ff1d01f1037", "value": "24576:/F/aeY5A6p4bO7oaufaiy8jfrPCF2rguglMgJN7DV:/FCeY5AZbONFIjKFiguez7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782312, "uuid": "4d211651-477b-4477-8e1c-2bfc5b29ee2f", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782312, "uuid": "e0459abe-ca14-442e-a602-bbc677101bf3", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782312, "uuid": "f8d9cfdd-1fec-49f0-8223-211d456e3db6", "value": "INF-BRdocsx.NDVDELDKRS.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2be6c6-4d5d-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1637782285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782285, "uuid": "90a8e2ed-3546-4fa5-9365-3c7f649c3597", "comment": "Malware payload (Neshta)", "value": "527501864f0fec233ec4eb0d1382e7ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782285, "uuid": "d4bde5fa-67ae-4718-a1f0-763e3c6b027d", "comment": "Malware payload (Neshta)", "value": "fe31f9f04529e00c72d2b8957d0ed1e4031c463b0850a68b04310b03827c6120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782285, "uuid": "e0471661-beb4-4b19-a517-86653c425b14", "comment": "Malware payload (Neshta)", "value": "384d81b5dbf1b4333d3898c9352b111bb5413d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637782285, "uuid": "14739a1a-1a26-4209-9402-8cfb554cf2cd", "comment": "Malware payload (Neshta)", "value": "8d8b5fd36f3c98b8f25418a545aa25e2132125b14f2c8f77a97bd860e7b246a9c51ee2bfc851de3b8a3b316a5b28b364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782285, "uuid": "53ab133b-2af9-454e-bb14-ee35ea57ccb1", "value": "T1EF54230B52C49FF7C79B473306B376BCD77AC898516A4AA717F02F3A5D7368A1006582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782285, "uuid": "d5667e2f-9301-4b03-a35a-6ce56691e648", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782285, "uuid": "f373fcef-7bf4-4b61-985b-c173d6e32cb2", "value": "6144:rGijCLluy0JCkI0INsbqb6vyMj8ZKhPFwbI0ej+dd3GZxoLGR2qOL:falSk6CsbHvDAZWl0fd3GkDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637782285, "uuid": "4606c9ea-bd52-405b-9b7e-35bdb9f9103d", "value": 288919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637782285, "uuid": "d2b60465-ba3e-4ff5-9f1c-7378958c6bb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637782285, "uuid": "087e4036-43fd-4665-8432-2b41a5444bbb", "value": "527501864f0fec233ec4eb0d1382e7ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }