{ "Event": { "published": true, "date": "2021-08-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-12", "timestamp": 1628812982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1993b814-7518-4b08-adb5-8b7a7b7d7374", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3755aaaf-fb32-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628747866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747866, "uuid": "b577ad90-ce7d-45b2-9f49-5ae9caa5be88", "comment": "Malware payload", "value": "b88f34b5a40bfc3bc3cb5e93fbb7cd3f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747866, "uuid": "3d2d4b26-3bde-4137-a29d-949d0794a20c", "comment": "Malware payload", "value": "0038863f41c80fb1927ab64b9a8f70003f809a8da6c8ef31787bf4c2a4f6062f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747866, "uuid": "1c747be4-1417-4995-8086-510b7ac6b976", "comment": "Malware payload", "value": "cad86cff3cc2643f5341b4791006da3bae0b5b3c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747866, "uuid": "de2ed6e2-32a8-4948-8b70-07e35fcc9ae4", "comment": "Malware payload", "value": "4ad5ebb3271459e4729c14248fa0c3bf54541a00ce9336544c866444463f61de6b564dc1c7e4ff24cbacfbfb341f9e9c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747866, "uuid": "f5bbb1e9-8262-44ee-b578-c8077323e9bd", "value": "T148537B07D444AA4BD26987FC6F4B0BA85F1D381ED2C26BCF142B9E46B7A0727194E49C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747866, "uuid": "da10cfb0-de51-4275-b26b-f21b04267906", "value": "1536:f7jlASCBqGSVtFhKFZlsI+FeSXTH5v130Poc/7:VvCBnSVpMZqI+5H5v130nD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628747866, "uuid": "a315b1d6-74ae-420e-9620-f45ba8991858", "value": 64707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628747866, "uuid": "245f1290-b61a-4688-b0b6-655879964876", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747866, "uuid": "79248b3b-4d23-47a0-8ea4-69c770599740", "value": "Press Release CIL Q1 21-22_final.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3b79d6-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628738636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738636, "uuid": "d406255b-c6ce-4f5c-9868-7d0ad6fe4617", "comment": "Malware payload (Gafgyt)", "value": "e02667f30eba7bc39cb9cc1ef23590cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738636, "uuid": "1ad994f5-4ed0-4b67-b2a9-62c6c377fc1f", "comment": "Malware payload (Gafgyt)", "value": "01a2780366ae3df7187fbd01dd498cba3b5035f0f5ddb6208aaff774a707466b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738636, "uuid": "7cf93e50-f3d9-450c-ad4a-5c984f7effe7", "comment": "Malware payload (Gafgyt)", "value": "a4dcc845ec032492db88666cd523a57fcf6113b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738636, "uuid": "63482dda-c66f-4bb8-9463-d776c908386d", "comment": "Malware payload (Gafgyt)", "value": "845587b16f110a1851b218a2289f6dea8298c2b3d225efff8e9f668dc783175bfd0f206208d17b290476c28f73778832", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738636, "uuid": "60a0bbcf-cd17-4ba2-97c3-c8ab1b62584c", "value": "T1B6734947A9659FB3C146AAB525E759300B13F8215F0F2B89713DAAF8430F8CDB80E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738636, "uuid": "51da3274-1012-4739-a1be-00b33f67738c", "value": "1536:8wyVzh0fcKepZ4tyG1NaEVx7Cs3yzvVrmj9VqYLe8f26e:PIzSfDeYyGl7/3MVmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738636, "uuid": "ed6c39d8-795a-420d-a801-afe51ddc2714", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738636, "uuid": "a2b99801-0231-42ba-9f91-14324a8ad589", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738636, "uuid": "b940a414-8116-4002-a0d9-3db5ba5122c2", "value": "e02667f30eba7bc39cb9cc1ef23590cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87af75eb-fb36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628749718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749718, "uuid": "b15432bd-1458-4101-9ce5-8c7c7d947537", "comment": "Malware payload (SnakeKeylogger)", "value": "878df7fd8ec553ff54eb7fae9d8cdba8", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749718, "uuid": "495007b0-a926-4ba3-af49-624cd39aca83", "comment": "Malware payload (SnakeKeylogger)", "value": "01d37601fd50c088f9be3cc2395e9f9ef3ffe3aee282147d0ebdd3bce0866cae", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749718, "uuid": "d62bb8d0-c285-453d-ab2b-ba511a66afe0", "comment": "Malware payload (SnakeKeylogger)", "value": "34dafcba5eb9995522969dbeefbfbd94328de240", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749718, "uuid": "d25abbb5-cb98-493f-9f8c-1486375993d9", "comment": "Malware payload (SnakeKeylogger)", "value": "5a27326fc78f1443c54be07a6db9ba3143b3b9c3ffcf3769dff6945fb6d21e0cb70bbca92129c57c2829646a5b442cbe", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749718, "uuid": "4a696d7d-7bad-4302-9b5b-b6e36b930895", "value": "T1F695B33C29B92627D07AD375CBE59927F4409CAF3161BD94A4CA73660372B5239C323E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749718, "uuid": "d619c3c3-1c6c-47a5-b127-6e9c686e9009", "value": "12288:+C3hpINYoA3P1/GyjcOgHf4uvP9H539XKfalV7T2fXOk/HmUVppUuEVCHo:+CTIN7EZVjcZHf4YbN6UV7T2fXOvOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749718, "uuid": "7d8913b7-a514-422e-9ca1-aa92fb139b59", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749718, "uuid": "51e2a67f-fe0a-45d5-85fc-bef145771417", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749718, "uuid": "4d41db92-383d-49ee-ba55-ecdacae909ca", "value": "BE-IZ-Q-1278-21 - COMMERCIAL.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d429ea7-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628749996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749996, "uuid": "1e3e6ddd-9fc0-4e48-b538-e48456c3d6bd", "comment": "Malware payload (DanaBot)", "value": "9a505d2be9d9d8efa97018f0bebe5660", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749996, "uuid": "d175217a-1b26-4384-857e-c1257cd3678e", "comment": "Malware payload (DanaBot)", "value": "02a931bd8d90478e89631fca772c3592ed2f12bb50baf4c5f989e512b80961f5", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749996, "uuid": "37c12e35-70b6-4f21-9981-e6c366fbc381", "comment": "Malware payload (DanaBot)", "value": "549be56cb07367345b5d1a8c24cf12a3117e9bb0", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749996, "uuid": "a137a0af-c99f-4f7f-873e-eaa652b42a9d", "comment": "Malware payload (DanaBot)", "value": "b85c2af775d82284eff6f79314d106ba9995715d7381e1b92e0bb75e38b694d4e572d1154f081c5bb40421fea4d1f659", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749996, "uuid": "cad7d2f2-3bc5-4c09-b731-ee6b53be71c0", "value": "T1D4450230BA50C034E5B612F85AB6E37CA83C7A71A73440CF62E56BF916356E4ED31786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749996, "uuid": "60bc64fb-1f7e-4a11-b5f1-88b6bec46e5c", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749996, "uuid": "e01c17d1-0837-43cf-9f81-81026268d33b", "value": "24576:SHtd+xuw3WhBvcCTVaYIEkcFiLOYeDZazGmvaNRzH2e:M63KBECBBgOYwZHgCRzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749996, "uuid": "c5e93efb-a618-4d9e-8fe4-f2c21f57037c", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749996, "uuid": "90db14e8-1ee7-4ef5-ab38-e00d1e62addd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749996, "uuid": "21a74791-3da4-4a73-a062-fc5ec2ab05b8", "value": "9a505d2be9d9d8efa97018f0bebe5660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d3e3a0-fb95-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628790551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790551, "uuid": "3e51570a-4eaf-4a1c-abbf-99509dab5a26", "comment": "Malware payload", "value": "771621f490fbf4ca91e178a73dfdc2d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790551, "uuid": "a753513d-19fc-4930-a604-803a87830a05", "comment": "Malware payload", "value": "02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790551, "uuid": "e8544d3d-3a55-4e52-afe0-e632eb67ceb8", "comment": "Malware payload", "value": "4649bddf320e91755ed969bf058c481141dd964d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790551, "uuid": "ac222ba1-0f3d-4ae6-9445-04acfbe250f9", "comment": "Malware payload", "value": "5916496ec99b061f83a9ff842e80b36c21c10832f9e3cdfeda2a69c474d432f10afaedce55f83814fbd0f05f5f32e6d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790551, "uuid": "0aa7eaf8-5d68-4faa-80e3-b40e13834b7a", "value": "T1BDC2AF569012E69ACAFC84F117D0503AAC06E790FF1893F571EFEBD5D9097857DE2480", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790551, "uuid": "5912a1b3-b42e-4f1a-91da-dce7a9e56de2", "value": "9c0432e1910a7f6b5d39ec1826872d5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790551, "uuid": "cdc3533c-d90c-4195-b8b2-5f60d8b43a2e", "value": "384:1dWWizxVb4MFzVeTDFNCPGmYeU6YzGutMLD7MXxyJV/H318HpXPmqD6oju9FB9Jj:1dEv4MtGm/fYzGVDGAv18JX+qtjGHGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628790551, "uuid": "eeb0ae9b-24e1-4a96-b8ad-d73b0f5e1eec", "value": 26824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628790551, "uuid": "6adf1572-40cd-4088-8671-1c13993decc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790551, "uuid": "80e01e91-5ba8-4a0c-aac9-b0051a9a99e2", "value": "02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bdaa51-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749420, "uuid": "88831b71-12a7-4952-b8b0-4a8ed66a42fe", "comment": "Malware payload (AgentTesla)", "value": "025e389f56f9f161aba410efb3852d69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749420, "uuid": "183ab488-804e-4e7b-a2e9-35a44eaa9199", "comment": "Malware payload (AgentTesla)", "value": "048018a914effd76b034cfab6722e2c8a341fad9955faa95ef39ab4622900906", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749420, "uuid": "cddc411d-2ca7-45ef-bd6c-f282c3809407", "comment": "Malware payload (AgentTesla)", "value": "0716c75a34c59f18d9e03a6af32bd14f6eb61351", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749420, "uuid": "ff1e0c7c-f9db-4018-ad44-21685b457b07", "comment": "Malware payload (AgentTesla)", "value": "1f76da4f8bb9041fb03337d21fa6fa57d4589e2bd86aa95251d9e09af3c4a95a4f6880435d53d4598e1327daa3efff6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749420, "uuid": "349375c2-dd9e-4eb2-8fef-79a5be97e880", "value": "T14CE402113BEC1B66F87E2B7A5675608203F7E14B4B22D52E5EC415DB0F3BF048662B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749420, "uuid": "3a260b9a-9ca0-4f24-85a3-42f91c7e936f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749420, "uuid": "c21acbb9-4b33-47cd-b913-75aff06a1a55", "value": "12288:c5i/HK7z4cMlBFDv1bnQYWot4kr/kV9A0d4/xgH8nlMDZFP5:uUJ9bQYk2kE0GxI8un5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749420, "uuid": "05243042-e2fe-4ede-ada0-537a1dbbf2fa", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749420, "uuid": "84bb2e7b-4587-4da9-9e14-2c613eedeb00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749420, "uuid": "9703c89d-24bb-4b51-9347-0407bac32eeb", "value": "MACHINE DRAWING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437bbbf1-fb95-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628790406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790406, "uuid": "603b43f0-8188-4d8d-8ecd-1786a0e1b970", "comment": "Malware payload", "value": "fa26af9b74b47ecd7facedbc0d06cbb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790406, "uuid": "a1b668a7-ae1a-4fcc-b93a-255678cac184", "comment": "Malware payload", "value": "04d0b37f0999063a58819d78b23443567de1a9afae93d7363ebe515582c8e474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790406, "uuid": "76b7d29e-e054-465d-a0ed-222980b8a5fc", "comment": "Malware payload", "value": "009f1e32f6d44f8e5967eaadbc04a9174af72e86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790406, "uuid": "30c33ce0-4f38-407d-9a96-75a49aa1771e", "comment": "Malware payload", "value": "6bfae2eb4c65c1e8c5c568f824005899c1e4ecba8eec0823517401b5c3a8dbdef6d722906cdb3290ce491c397c1ba68e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790406, "uuid": "92e4b0f2-e505-4989-b04b-14ba489ca0ef", "value": "T1E4F41217A7B20616F0CA06B11A5058F61B36FCB327065D0FE7866F1C59F2A8578E0BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790406, "uuid": "1e3d003b-664c-478f-93a4-30db4476477f", "value": "12288:7rEBIaeuYHkdC3FqNuhn7/nSsJqMc5gAjltu3Qf1w0F7GPgj75Vf:/E0lHcgqgh7/0tgIugNw6GQlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628790406, "uuid": "377cb40d-8abf-4bbc-aa75-d9a3afb0c222", "value": 788808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628790406, "uuid": "5f86d0bb-3aa9-4afc-9733-7a499d9c17b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790406, "uuid": "70225ce4-4706-4974-b68d-453f72d80b6b", "value": "fa26af9b74b47ecd7facedbc0d06cbb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60293571-fb48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628757383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757383, "uuid": "9e4597e6-3b58-408f-b7dd-6ae012652abd", "comment": "Malware payload (Cerberus)", "value": "03df6d51535847b17f543b7e92d4522d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757383, "uuid": "7ea2e55e-87f0-4c41-a438-6d1b0ef8e995", "comment": "Malware payload (Cerberus)", "value": "056d2705bced05e78209e95c0fd5314f1714ed9de7103fe39ae769b0ec42188b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757383, "uuid": "5867e8f2-2cf3-4ae8-9595-c588d271a84a", "comment": "Malware payload (Cerberus)", "value": "04b256b3fe13865bc67c10ac2315daa347211573", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757383, "uuid": "3b28b803-6fd9-4a7d-8aac-fa02a7361c83", "comment": "Malware payload (Cerberus)", "value": "72a27a1867a39f1d8598dcc5b6d8c6e40dda8d2fa13c1f97a59e9be3f08a2f4ecc64e91173b618ce008674cecb18a918", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757383, "uuid": "8c683382-5933-4e18-ba31-392ecfb35a3a", "value": "T1C6E5338D6752880DEA6BC231400B7952B6B6D21D67C27A3F186C40D166F7FC48B4EEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757383, "uuid": "ca9d2f14-f21d-405a-b379-9542cd9fb71e", "value": "49152:CrgwsjNyjDq+k66/NMCk6V5Dx5NHbBoPO7ftgHdh1dEgwKPwfTbnScR3/CN+F:C4YjDO6+NE6V1Lh50hgzwwfXnSzNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757383, "uuid": "a68328e7-c093-4957-b931-ba49eb9ecbe7", "value": 3165429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757383, "uuid": "b0bb8cc1-728d-45a3-a194-f2d7efe3bd9c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757383, "uuid": "842c81d7-94df-4e3a-a45e-092a40792893", "value": "Antivirus_Android.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a68a42e-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767144, "uuid": "52d8c6de-cbe1-4bd0-a827-c0d524905021", "comment": "Malware payload (Nitro)", "value": "45b3bd0d1d388b5802d643b9729043e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767144, "uuid": "af829bb1-706b-464b-830b-ac9d5e5fc546", "comment": "Malware payload (Nitro)", "value": "056f57fb1be7827272aeea42c255cfb62f8c9960072eb9a1a7464d2abf806e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767144, "uuid": "b6335e39-9ea3-4abb-a654-de66aab83dd8", "comment": "Malware payload (Nitro)", "value": "8e9fce72a1fe5f46e4057b5123667087c1d8e379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767144, "uuid": "9b87cf8b-384f-4223-b4ed-cd109a8f3d51", "comment": "Malware payload (Nitro)", "value": "9b40ac6fc754cb8dc50605c3435ca25a7b1a94e9f69cbd085063ed1a664dfb29493328d46a97fcc398d2ecb152793afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767144, "uuid": "3f517730-c27e-41a8-969d-ba1201866e88", "value": "T10F5365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767144, "uuid": "2a589ec1-7292-45ee-b504-49d1e23bb908", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767144, "uuid": "12cab48f-6e37-4312-9143-d138d02ea6c5", "value": "768:VOucKn7n1JDDfANIUuoXLDwUzc80gmq3oP/oDB:VO2DDfAPTr/0O8/oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767144, "uuid": "085ef7fa-0422-4f87-998e-cf8864db5beb", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767144, "uuid": "543ff20e-f784-44bd-ac57-c33fe0b9046b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767144, "uuid": "f165f70f-0cc9-4654-be44-0c3c077c8f67", "value": "45b3bd0d1d388b5802d643b9729043e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1faac0-fb87-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628784700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628784700, "uuid": "6ec52a37-ceb2-44bd-917f-1917d9a9381f", "comment": "Malware payload", "value": "1d6928d50f2044baac69199c511a3488", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628784700, "uuid": "0476b5f5-830a-4ff2-993d-c739c2505171", "comment": "Malware payload", "value": "068c4196fe5593d7417d064026c0d5bc0b72f3ac5e48405ee99bd01b7cde4ab4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628784700, "uuid": "cf47842f-fa9d-429b-947c-db8481523ba5", "comment": "Malware payload", "value": "90c1971880a2bfcfa9d54be041b3cc8fdb43dbb4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628784700, "uuid": "deaa6709-1ffc-4ef2-9b2e-d1838a820512", "comment": "Malware payload", "value": "233ae59aeb44a0ea7807d485e3a0742dccb8acf47a128df8c4dd8b292d73d00d1f61b7f4582361a4a1af505de1d4f735", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628784700, "uuid": "8aca248d-b80f-46ef-b5cc-eb65d5280c12", "value": "T17EA50142F359E827C433C2365A751366601ACD588E47F7972906B7BC6DFFE988E81AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628784700, "uuid": "1f106db2-4fa7-4cba-8298-264ca3e2e487", "value": "49152:KcmHVErBjCreEd5z40HXKAzlJhy9UzOpLv4tm2MR:oV0BMXd5MOXKElyP8teR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628784700, "uuid": "2e5e355c-6799-4c58-a0dc-ba4aac8af061", "value": 2111903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628784700, "uuid": "540fce67-8c5d-4ef5-9f79-de3a30aa8dcb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628784700, "uuid": "0611eaac-8d94-4031-8f36-26a6cd3bf9fe", "value": "Downloader1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79248c3-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628756644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756644, "uuid": "914121b5-4175-40a4-b8ab-7cc8ce8bf82e", "comment": "Malware payload (AgentTesla)", "value": "77889d3ccee73656d21bd2f2e3616e42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756644, "uuid": "8730a4e8-5431-4dcb-92a8-f7f27da6ec41", "comment": "Malware payload (AgentTesla)", "value": "06d4b51b902abbdd0467d07cf37e6ac59a2041cc44daa3d99f67e36ffd630513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756644, "uuid": "08df2564-0c83-4d63-b49a-1a2256227783", "comment": "Malware payload (AgentTesla)", "value": "81c9054729336c786d827f27d0c9451703809ad5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756644, "uuid": "48c17509-b760-44ed-ae45-c0243401a75a", "comment": "Malware payload (AgentTesla)", "value": "8d379e98acb9bd69229bcbf8c75525f0e4fa7dacbc0a39c493f9684d005ed6fe1fd309b9db785b1ae07a327ad579d03e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756644, "uuid": "cb6f7bed-fa19-4e81-859f-6750f720c22d", "value": "T1EC54F1A272E1D6B1E1690A398438CF75461EE9705E2FEDB3B78419274F301F08967F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756644, "uuid": "3a8e853c-bcfd-48d8-9b20-c2c8eab75b16", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756644, "uuid": "3bb5f0c8-0f69-4d15-a01b-5f942523a7d1", "value": "6144:vhnRiOn4l6x6trqoPZhAkWBcXpso9YdXY3l6u73NhxnOSrh33Oh:vhnROl6x6t3PZu7BcW6R1HphxnOY3eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756644, "uuid": "43ec3ed7-2d49-473d-9f3d-aafd3e2bb0f5", "value": 306276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756644, "uuid": "e8c81dbd-ec38-4f14-bbba-a217e642f43f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756644, "uuid": "ea307cb0-c6d7-4d3c-9320-1b255984a74f", "value": "77889d3ccee73656d21bd2f2e3616e42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809305d2-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628767316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767316, "uuid": "f2c3fa46-d3b1-4c8c-8f8d-062c5655e342", "comment": "Malware payload (Cerberus)", "value": "656f990f102f08e3a45f2f6589252680", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767316, "uuid": "9d345b74-e9eb-43ff-ab6e-e4d5fd6d9303", "comment": "Malware payload (Cerberus)", "value": "0706aff99ddb41d810d081490cb6b2b70d9ee0092a642716d7ce28011ce616a5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767316, "uuid": "41bbfe02-31d9-45ab-ab7d-3379ede6da40", "comment": "Malware payload (Cerberus)", "value": "ff4bad4571d264078bde20b69225f23d890948bb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767316, "uuid": "481aeb24-a7c5-446f-b95f-2859cce89c16", "comment": "Malware payload (Cerberus)", "value": "1920409fc3579abc5883c1422571cc24770e1eea717231f8dfa94e17709395e131fa301ed097c1a22e65834779868808", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767316, "uuid": "774562dd-0aec-4402-9547-cf4533129f9a", "value": "T115D3F14363A1185FE4BFBE30179DE76377B209A8A6A4E7E35E0450589C273B71F48E04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767316, "uuid": "d36e331b-ea93-4c0b-a6c1-db2841b54e69", "value": "3072:VwbbTsEjNCvz4wNIkNGQlUFIEByO9Ng01uLuIQ2XzXcv7:eXNgWrIIICDS01ovQ2jsv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767316, "uuid": "e45c95c2-e96d-4c66-a6a2-8af1a192449a", "value": 136619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767316, "uuid": "6fe35f91-5db5-4c40-abce-e02105bb00e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767316, "uuid": "fb122768-ca93-46b9-8f99-99ce2c4918ea", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64af2403-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766839, "uuid": "ed871f7d-0865-42fc-8a64-ffd6d8c18162", "comment": "Malware payload (Nitro)", "value": "1e3623db60060f182ce3d37907e2350e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766839, "uuid": "f25df9ec-0536-4e32-8578-47c2b658bf42", "comment": "Malware payload (Nitro)", "value": "07b087b1e455c0efabcb704ba89195b9f3b0eaa81e232cafeca3c1822ed8ee91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766839, "uuid": "25a49841-94f9-4eae-8f52-4d042bea8df4", "comment": "Malware payload (Nitro)", "value": "b94c22c40c149b9265ec56f91f38ef080e5a5bfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766839, "uuid": "ffcc69ac-ebd9-4098-9ab7-f20e1fc953a7", "comment": "Malware payload (Nitro)", "value": "183423a0141196168e111a609a4e8edad8a1a357c59bb9085e6ddc4f1af9ec593d7e3281ae489df88f9d6330b89e67f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766839, "uuid": "cf450a50-7d4c-4c63-99cf-83d33d749f1d", "value": "T10F5365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766839, "uuid": "2bb69f72-a7df-4929-a4fe-8c68e1dfd22a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766839, "uuid": "41d23d0d-5746-429d-8b85-bf60e716f01b", "value": "768:wOucKn7n1JGDNANIU+svLDwUzc80gmq3oP/oDjs:wO2GDNAPrr/0O8/oPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766839, "uuid": "4ac7f9b4-07b4-4c47-8d33-15f2b8acd06a", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766839, "uuid": "f7bbbbb2-2ecb-4185-9fe2-77a9dff3bc32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766839, "uuid": "12d80be8-d158-411e-8e3e-b20de37e8cf4", "value": "1e3623db60060f182ce3d37907e2350e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d209e9-fb01-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628727079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727079, "uuid": "031c32c8-4d5c-4121-ace7-5cff3c8edab1", "comment": "Malware payload (Mirai)", "value": "db68b4c0867cdcee222b2f0eb16e88ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727079, "uuid": "b46c3698-fce6-41e4-9336-e7606dfd83c5", "comment": "Malware payload (Mirai)", "value": "07b52305141ee4a4fc75a5b3952f4df8c9e15dde6eae5997657f19629ca17c8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727079, "uuid": "428b3708-8950-4a19-9def-875a458d640e", "comment": "Malware payload (Mirai)", "value": "81879f59a29a9b834a732c545ffb2e94d0b63d5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727079, "uuid": "e1897fdd-a1ac-4780-84a2-9a12205a8f42", "comment": "Malware payload (Mirai)", "value": "7ea6c3cd0e15ae3186363e9756278ae09cc0905bdd5f6b7893e61bccb98428939ec5fa5144654382d4d07e6f37ef2302", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727079, "uuid": "41f35200-5bbf-4980-8504-1a9ebe9bfbcb", "value": "T101633995B4029F3CF88BD6BA94170E05B921638547C30F2BA6A6FDE37DF3054AE25D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727079, "uuid": "c60cd757-f5e1-4aeb-89ea-b7386b7398a0", "value": "1536:yKYDydkSp1P4HCnI58Ok/Tgp+nTuRb9D7C:yKYD/S/PaCIM/xTw9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628727079, "uuid": "885720cf-9494-43b8-a9ca-2b9f6e69da18", "value": 72332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628727079, "uuid": "0adcc611-018e-4846-b44c-5948ab4bff57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727079, "uuid": "2be749d6-a9bc-48f4-81ba-ab9c46c32ac4", "value": "db68b4c0867cdcee222b2f0eb16e88ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73029eee-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628755267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755267, "uuid": "15d36851-87bf-4e99-85dc-5500f36772cd", "comment": "Malware payload (AZORult)", "value": "0f6f163d19df558e01d3edd0c6f64604", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755267, "uuid": "bd9543f5-8971-48a4-9aa9-fb68db1b6d61", "comment": "Malware payload (AZORult)", "value": "084fec54089b798a4eafa125383f09f1cdad29740f811fb531910ada45e240b4", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755267, "uuid": "420e541a-7129-4483-8999-c6a4b3888e79", "comment": "Malware payload (AZORult)", "value": "03d66cf249c2445c539286f0ed2a4e93387c2e8e", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755267, "uuid": "554dc6a3-513b-4717-ba63-d387711e6ff7", "comment": "Malware payload (AZORult)", "value": "7300687d4a0d598c976207c25222d47345f8838e6d54906d23751502a43056ec1279248ec164b2b910af09a4d6ae7646", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755267, "uuid": "5e2f2987-1cb5-4b58-8288-e6b7d63d2078", "value": "T136649E30BB90C034F5BA41F845B69378A62C7E619B3490CF92E52AEE57346E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755267, "uuid": "7563b1da-9f91-4997-ad46-5901ed060e40", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755267, "uuid": "de1acf03-48cc-47f6-a96d-662ff1282e1c", "value": "6144:I0+wdxKvZVIyMVCoIvKP2YMreWcJH0cEhWLWl5w:UwdwXIyAhhP2YMDcScEccy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755267, "uuid": "1a0d5da9-b10e-4925-9643-ddc86568e08e", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755267, "uuid": "4caf1d12-271e-4c6b-8cda-b9844b9b3a5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755267, "uuid": "e04adb68-259d-450b-959d-16a0ff86bd7f", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0f2387-fb69-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628771633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771633, "uuid": "12c12b79-7e0b-407c-b062-6d00c859feda", "comment": "Malware payload (Formbook)", "value": "d0c4f48f0b69ee5f08f7baf1460229ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771633, "uuid": "33eee181-5851-41c4-a1db-46d008461e2e", "comment": "Malware payload (Formbook)", "value": "085dd3415a1c0c601af338a15905c650935e18505e6ca71bf6ece1602bba19c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771633, "uuid": "7803d1ed-fa4a-4785-9e46-f3a5a80134c5", "comment": "Malware payload (Formbook)", "value": "1da3fd441ec04d0207d020300168b3b83f16d8b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771633, "uuid": "9a87ed5b-0692-41e2-b4e4-7780ff183d5d", "comment": "Malware payload (Formbook)", "value": "b377c46e983da4058f3f44d9ebb8fb8ca3c8a1df5c2a6ae3d41233aa69ac15132e66ab1fe83b970fef73c2ef39a30ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771633, "uuid": "83e54f16-6c41-4ad3-94de-2e2436ea96fb", "value": "T19F65D53C29B92627D1BAD375CBE59827F4409CAF3151BD94A4CA73260376B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771633, "uuid": "18409dba-be1f-4708-bf0a-a62d73fc02b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771633, "uuid": "a67771ce-b047-4358-83b9-fd187359fcce", "value": "24576:938hI5q8Bm8Mj/YoUOa9QQoehT2fXZvOi:u3HrjAowQihT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771633, "uuid": "091f0acc-c196-451f-b27f-8f37b4fd77f5", "value": 1436160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771633, "uuid": "e1f4418e-e2d4-4a7a-b338-d084d40be110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771633, "uuid": "9084eecf-3a36-4fbd-9d7c-8775cd0a97e0", "value": "siparis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89cbb92-fb2f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628746821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746821, "uuid": "f6a5d649-523f-41d3-8c6c-19940a558a6f", "comment": "Malware payload (SnakeKeylogger)", "value": "804c2fb52752597cd0fdae9838df7d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746821, "uuid": "7b0b032e-3ce1-4d14-a55e-6e6ca7137e88", "comment": "Malware payload (SnakeKeylogger)", "value": "0a101b8b739c481e387e2daf5d85aaa93cf0188ff798233817e2e349b7ac1fe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746821, "uuid": "0d6082fa-50b4-4a59-a9bf-ac594c6fe146", "comment": "Malware payload (SnakeKeylogger)", "value": "a5ebf568c0e7f81a5f6854ed9a690a948f804dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746821, "uuid": "c77695d2-5bc3-4979-82d5-ecc28e779228", "comment": "Malware payload (SnakeKeylogger)", "value": "d6e65d92874c92ba0830a5c9a73b41992657a734bd7e7c542611be3e2a257cda2f996396e0eca15156ed8a28cbaecb17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746821, "uuid": "3d475ec1-9ae1-4b4e-82df-5b5bd335774d", "value": "T1CA15AF2E76C04BD4F2720E7DFCDDB01076B9BC015A43DE2BAC987629542F6958A3219F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746821, "uuid": "4d9c55e8-9353-423d-b5f4-526cb22749d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746821, "uuid": "3ca8f790-ba83-459d-a456-3f992be1ba73", "value": "12288:sJtPdGVDaHK7zTe++KINAeU+dy7fOhL8sCTqegHCcxvKIHWBSGm:sJYO+VluZL8sCTyHlZdH2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628746821, "uuid": "644e7aa6-95f9-4e2f-a440-7a4fa5dd6589", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628746821, "uuid": "12c515bc-fc31-4d6e-804b-97e427b26398", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746821, "uuid": "87d5ba2b-b5fa-4393-a425-4f4712c07aa1", "value": "QUOTATIO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2824a175-fb34-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628748699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748699, "uuid": "01cb5bd5-ba7b-43c5-938d-03276a9349f0", "comment": "Malware payload (Formbook)", "value": "5c5a4fd610f0280cdd7974f05f6e9dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748699, "uuid": "bb40017b-a8a9-417f-be3a-be342a4a7f0f", "comment": "Malware payload (Formbook)", "value": "0ac18a14f9f6bc187d707c10800aca93298b7ca07bdf43994875ff8d93f6d01b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748699, "uuid": "c26dd678-7408-473b-a67e-69f3e00bf64f", "comment": "Malware payload (Formbook)", "value": "ab1bb4fe48edf3de26ad23ff8e8c7337670e722e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748699, "uuid": "7a21a5a6-af0d-4655-bb1c-19bec2c9346e", "comment": "Malware payload (Formbook)", "value": "acecadf25b2304a31181004e8d1109b9053819a3b717f98d2fa96e2856f6f91008dc9338e405931271482d35244e5918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748699, "uuid": "d2382841-28c1-4b60-bf8e-0e181c507bf5", "value": "T19665D43D29B92627D07AC375CBE59827F4449CAF3161BD94A4CA73660372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748699, "uuid": "c387c6dd-37d4-4cce-84a8-7be5cfb2a88d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748699, "uuid": "c227c1bb-37cf-4967-b437-d7c64603305b", "value": "24576:tsjYgPyn9C/uG4M7yjU4++UQwgzT2fXdvOm:izK9nGb7yjQZgzT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748699, "uuid": "693cd46a-ebcf-4239-9fab-6769a1ef8ea8", "value": 1452032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748699, "uuid": "5af3b7ef-9a70-4a5a-8611-426d501c22e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748699, "uuid": "1c8c995a-de9c-4935-92e4-77c15e9e6325", "value": "INVOICE0005672348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befaa554-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767420, "uuid": "8c0ef0bf-7b8f-4242-85be-f9a76f1faef7", "comment": "Malware payload (Nitro)", "value": "931727d01f632cad67329528d1ae411b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767420, "uuid": "ed11d8d2-3864-4d85-a391-19a8d719db71", "comment": "Malware payload (Nitro)", "value": "0bbe7b85d022ac808df0589304f506c753768562d3b88561f5601bddc758d4c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767420, "uuid": "8e6d9a38-de1d-4766-9200-067198b0cba9", "comment": "Malware payload (Nitro)", "value": "9834a272c713b4de00ec6954d03c7931620e2804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767420, "uuid": "e36056aa-b691-4c4c-8a05-a3e6731cf057", "comment": "Malware payload (Nitro)", "value": "49693c6d9665ad800d2f6d6898d37dc33120ed04b0c3644b1a2a50ffd6f7c09ec9ea4652d60b3bf69710cd799c16c0cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767420, "uuid": "3ec002bf-4dcb-45b5-8097-b845610327aa", "value": "T1FA53532851738A2DD87C82B815FB2F7C27B0AF166460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767420, "uuid": "26ab239b-7bb7-4445-897e-9b50d3139c4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767420, "uuid": "eb4125e4-2f6d-49da-baf1-9a721911f5ed", "value": "768:nnby9UTTGitqI7GNI4jimYLDwUzc80gmq3oP/oDr:nnbn97Gxjsr/0O8/o3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767420, "uuid": "e2b2b6aa-d67e-47d1-ac6d-aa6b1148c9c9", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767420, "uuid": "4cc5d460-33f2-4b65-8422-6598bcb47138", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767420, "uuid": "7df22e70-73e4-4df7-8875-2b211c8022b5", "value": "931727d01f632cad67329528d1ae411b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a0fc1c-fb56-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628763323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763323, "uuid": "17ab4c62-2530-4779-9ba7-68b93408a91a", "comment": "Malware payload", "value": "3f0ee2826f3fe86325e835f36e58812c", "object_relation": "md5", "Tag": [ { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sourcecode", "colour": "#0937B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763323, "uuid": "7de1fba9-de67-498f-a2ed-eed0aceafd01", "comment": "Malware payload", "value": "0c35010877a541b091b9b06f8308c5003c8c38c3480b240674d166eb33e0cac8", "object_relation": "sha256", "Tag": [ { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sourcecode", "colour": "#0937B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763323, "uuid": "d45eadfc-a23e-4622-aa4c-400e380113e3", "comment": "Malware payload", "value": "32f0431a172df5f4c126da22e40dffbf425e8242", "object_relation": "sha1", "Tag": [ { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sourcecode", "colour": "#0937B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763323, "uuid": "114677f8-e672-434b-b8f6-730fb67cecd6", "comment": "Malware payload", "value": "efa64f42e2cd4bb1f36cee21a0b837e7de172103029ef9683a194312929c7b3f92bc1b9d311ee686c4ac52223953cc83", "object_relation": "sha3-384", "Tag": [ { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sourcecode", "colour": "#0937B1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763323, "uuid": "adb0d02e-e8a5-43cd-a6bb-49e0fbed71bf", "value": "T1ACE27D04F10F18BCD92EA6BD95D68F39DA22F5E38094B30B5DE2DA64891AF1C7D0C12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763323, "uuid": "d4c94153-0906-40b0-8a08-d17c8053da56", "value": "384:KGJLJMyMppcQarnXfIYYmrBBZ9M0sRvGECnbFPy6sTCL6eFlv7vUlWohJuXAkkS2:KGL5TX7jJM0s5ybBpDvzUgQJuwECrU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628763323, "uuid": "30663b62-067f-4661-b1f7-15d012a19cfe", "value": 32116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628763323, "uuid": "d534a100-7b68-43f3-8562-afc606a9ba3d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763323, "uuid": "6c7b9166-b9dd-46f0-86a3-f74e8eb785ce", "value": "Nitro-Ransomware-master.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed2e87f-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767393, "uuid": "e18e5be6-02fb-426e-bee2-116aa83edc98", "comment": "Malware payload (Nitro)", "value": "67953c1657f411a1ae0a245d1d35e188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767393, "uuid": "da5b0cae-5cb5-4c23-bf71-43f75a1ef976", "comment": "Malware payload (Nitro)", "value": "0c4ee9b485e88c5c27337addd8215eb2c79c3dc98a7e04f4b31b74b2e50fabf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767393, "uuid": "8d905639-3b32-4bcb-bb78-00d85b822c3c", "comment": "Malware payload (Nitro)", "value": "83f43b0c3de68dafce1e56bf65cc8401f9d3ae1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767393, "uuid": "ed9dd80d-9e80-4081-9e7a-3dd6a932a460", "comment": "Malware payload (Nitro)", "value": "cda89a45ff21063df8a3e4f133a0e543507dbd46564e52b55a446e885c1b47c9551fa15cc5eb1b4a503fc3e96989cd05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767393, "uuid": "555de31c-888d-4ca2-b61e-b54b37d596b3", "value": "T1E813E001ADDE9167CF6D03BC4CA7C78C1FC616362462DB9BFD10A2940DA77826A193B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767393, "uuid": "6a8c2b3f-c004-4b3c-8a11-1011daa69b50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767393, "uuid": "bcb00337-d55e-44fd-99ef-b8dc60980bbb", "value": "768:o+71Qd3NHKp5pOfvIhvIWGDP+nJVsF8p1qwATM6Rx61vXDFIryKVk+mqRcMs+uU:o+hQd0FOevP5731qpwYx61vX+eWkkckV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767393, "uuid": "aea8812b-650b-4dca-8ece-46c79010ceae", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767393, "uuid": "d72880c6-3a88-4a9d-9dd7-5eb703b7c1ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767393, "uuid": "85d3fb5e-1987-42f6-9bf0-2646468f1518", "value": "67953c1657f411a1ae0a245d1d35e188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaa5e56-fb26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628742905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742905, "uuid": "20c7d374-eb26-4b30-9178-eb89f2af4246", "comment": "Malware payload (Gafgyt)", "value": "f69162fd6efb4679bb45ca1f40ae6d85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742905, "uuid": "e0a5e540-c996-4299-8fcb-dd32ddc52f09", "comment": "Malware payload (Gafgyt)", "value": "0c9f501d8021aec7cecde40d3eecde3e0ffd831f4ffd9e35e16b60bfe45ca591", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742905, "uuid": "3f667cb0-e1d0-4b1b-8b9b-407c007ad4f0", "comment": "Malware payload (Gafgyt)", "value": "154bc3dbc0a8245130b1df6152b4d99171fc94c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742905, "uuid": "753c34d8-0631-4d92-a39b-31be640939ee", "comment": "Malware payload (Gafgyt)", "value": "84a3a3bbaa472de9d3419d0fec9525dd3cb4108479048a0c48ee3848a6b5d02aaa6b7753532c19ea6f8d5c2982aefa92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742905, "uuid": "88862805-9cd1-4612-9557-8edc91b3ca54", "value": "T103230A02AA46CAB7D8931AF602E76B664631FD690F134F45E31CBCF4AB234C8712B755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742905, "uuid": "50fce886-e557-49be-b5cb-b6543217ad33", "value": "768:Kgt6wTPL4dKYWUTeRCiAUTvqRI3HRampwEvBIVIYpwil1aVdcS:ltXz8JWnCATvR3HR1BQ7e5cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628742905, "uuid": "3d7e1b84-c24f-4ccb-bf4e-5ae21206f751", "value": 48300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628742905, "uuid": "cff2852b-f2ac-418c-b488-d28704526f0e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742905, "uuid": "52138ffb-0c85-4c97-8691-417c531c8992", "value": "f69162fd6efb4679bb45ca1f40ae6d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8499f6a0-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628767323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767323, "uuid": "b4ea4c32-6e10-4e6b-b561-513cdf9676ee", "comment": "Malware payload (Cerberus)", "value": "5d3208fb4a6125b7d960feba41c82d03", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767323, "uuid": "d3a67580-92cd-43cb-89d6-9d7a0726fdd8", "comment": "Malware payload (Cerberus)", "value": "0cca23db60ebdea20cdfe82c862d2bc69f0b4cb4a6e2f84127738f6f8b78032c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767323, "uuid": "beb828da-753e-4f32-9ac1-a9000beb280f", "comment": "Malware payload (Cerberus)", "value": "0a3cd6aec89f8ff1af40f0311b9f64c392c1b662", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767323, "uuid": "ad9c6e4d-8976-4490-9989-22ae7b958795", "comment": "Malware payload (Cerberus)", "value": "7db0e26e983fff8a0ecc3a5babb54e69c5fd3b24873aa114b3366ebbf7f068549f5cfbb28de21a22e9601c02dde987c2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767323, "uuid": "1bb28350-53dd-4e31-87d7-154497eb7e96", "value": "T151E533D9B7568D98D16F83F2804B3213F7A975EC0581623F0D728490389BEAD9A4BC7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767323, "uuid": "3a42d505-b136-4735-9df0-e66e425dc429", "value": "49152:hVb9OjBDyCiM+HLy5Ad+cqG8MNwZyZMmMwNjooFg119+MkYha0ZGtVT2K/zvjN:iBmYkHwcq3MNEyumM0Fgz9Na2CT2K/zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767323, "uuid": "05d8f26b-10f0-4739-a51a-707af0717316", "value": 3075106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767323, "uuid": "fdd90d13-3b98-4fe5-bee4-b3da712e8c8c", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767323, "uuid": "4add0a21-6258-405c-9b04-9766b456fa08", "value": "Turkish_Porn_Videos.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155dfb34-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1628749097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749097, "uuid": "c32d0938-a0e2-4e5d-9556-a5f07761b8bc", "comment": "Malware payload (Pony)", "value": "296381c5897f1b3d65d0bf087f0e2117", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749097, "uuid": "f4ba987c-7aae-4f0e-8364-cab417dfd213", "comment": "Malware payload (Pony)", "value": "0e2278517c0a64de6cd03d9ff5f3fabb125492f010332687a39561d4a6a56a36", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749097, "uuid": "6cbcade9-611a-4fb6-9385-76faf846b5b2", "comment": "Malware payload (Pony)", "value": "d306255b1a5faffd0dd1f26e0d3304f855365ab6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749097, "uuid": "22ed164f-285e-45c6-8c28-cd29892a59f4", "comment": "Malware payload (Pony)", "value": "d10a93a3279d3ca8d5149c3c89c9d95770289e45abc3c42034a9fe12c2737907bfa051e662368e44ebbc7b8adf7b8a2a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749097, "uuid": "39b1e0ad-8ea9-4c8f-b399-9bedc487b5d6", "value": "T1CC140FACC02746988F8977B9272B5F42118CBA7DF784A5337224577827E6E7B901393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749097, "uuid": "1e142dee-140c-474b-b356-ccb3568707aa", "value": "384:7h47EH7GGHG3jaMtrfgCWmsa9sg0ZAVa6Ugc:7h4AzkfHWj+la6Ugc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749097, "uuid": "a5375e2e-6316-414c-8e42-bb6ffc532af9", "value": 195354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749097, "uuid": "a9b0fb0e-89f7-43b1-aa27-512fdd72b75d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749097, "uuid": "d75dd645-c548-4bc5-92d2-2ba88343d351", "value": "Stamp PI.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90af9302-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628749304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749304, "uuid": "cda63fdd-5163-43c8-b3e5-b610965330bd", "comment": "Malware payload (Loki)", "value": "02a215328b0ad93f17baee31e662b747", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749304, "uuid": "9edfc4ec-039e-4b70-b676-7da0a3b0a52e", "comment": "Malware payload (Loki)", "value": "0eb3a85b182cc95a25ab7989ca5ab7463cc729d8c2dfe0fb5a0e1b009197a148", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749304, "uuid": "adb63ab6-2141-4559-8e19-385fae71e81d", "comment": "Malware payload (Loki)", "value": "cafafffa24ec4f7c8f430b3ba90291f6fd088143", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749304, "uuid": "341ab724-5ecd-4d20-8fbe-31f138756bbd", "comment": "Malware payload (Loki)", "value": "3a68cf0dbc90b321198b804145e65805e79c17b948f4d763601f5e750cb13b42f8d89525586a9adb32b0b844239e17d1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749304, "uuid": "fff7b27f-8c37-4a6f-87b3-c4a834f3639f", "value": "T11C451212E4C61B6FF84DA1FA0E69A3A1C98CECB4ED259D525F11734E927263D0BE3C14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749304, "uuid": "fd214433-bb33-4d81-b345-b1b4f0bfc962", "value": "24576:ZsH9MkxFtRuOASvrPOAuWxXWP6Ir33tjViT6kLLhS1AiwQERb:GH9Vun6uWxXRC33dVehLh+AiL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749304, "uuid": "fb9d5209-afee-4625-992f-f54c358f2656", "value": 1199400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749304, "uuid": "7a32a147-76ea-41cc-9d90-0f6e232af7b3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749304, "uuid": "08b8d9f4-2cb1-46dd-9394-17706162cb27", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4caa72d1-fb75-11eb-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1628776678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776678, "uuid": "9f64286b-60e3-4614-a8d0-d4b6eaab32fa", "comment": "Malware payload (KPOTStealer)", "value": "410cfb38603295dcd7f0c380ccc12985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776678, "uuid": "2f5ce7b1-73f8-4944-8933-32f8b8009f49", "comment": "Malware payload (KPOTStealer)", "value": "0f8024be3da4951480fa2fc6459426d7a4b0d9f46ec8fcbb04a3b8ccfca674d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776678, "uuid": "5585d554-acfc-4bec-a05e-148189f088a6", "comment": "Malware payload (KPOTStealer)", "value": "7f4b2b082e867c4c0ea8d0e5028c19b51fefd8c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776678, "uuid": "5b4a005a-add7-46b9-902d-77dfedddeecc", "comment": "Malware payload (KPOTStealer)", "value": "05a3e462fb83f612e4d948ad39c64070aa18b210b49d776a2fc37b0abc9054ee412ce2ceae7b325a74e4b649eaa1d380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776678, "uuid": "bffe2bc7-50ad-4f45-bf1e-d2d80cf58efa", "value": "T1FDA4DF30BA80C035F5B712F855B693BCAA2D3EB05B3590CF92D41AEE16746E4AD31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776678, "uuid": "d22c4288-64f1-4fdf-b4a1-4ac2c6003deb", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776678, "uuid": "67c842ca-e560-412b-b771-f91e3a9cadf6", "value": "12288:IijGKII1Zof9SvDPNTHR+mRrCGchV8zzf5dPEOA:lqFI18UTHR+8CGU8v5d87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776678, "uuid": "7ca65af7-a8f5-4489-8386-e62ed795ea08", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776678, "uuid": "e2cd535e-2c2e-40b3-8645-39e3e9751cc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776678, "uuid": "61fa1c59-6e41-4e0e-86a4-d30b1cef3a8c", "value": "410cfb38603295dcd7f0c380ccc12985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faed6a6-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628767207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767207, "uuid": "1e1a8876-3ae6-47c3-9e58-e2f4dd74b584", "comment": "Malware payload", "value": "bddd6ad4c8b66a3f551fdc47d6e12c53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767207, "uuid": "0a9f5a9b-2ec4-49fd-a632-5bf5f86975ee", "comment": "Malware payload", "value": "105897c4dd3369b8c8ae8956ef2e8d945c33e7172022d81e0791546d9c17b21f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767207, "uuid": "cbdbe018-9121-433e-b770-6d9fc651360e", "comment": "Malware payload", "value": "e8b4a0e7918eb4641ce971df0020bf318b5f6788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767207, "uuid": "f3c2ebcf-4e4a-4171-aef2-d23a50c2d107", "comment": "Malware payload", "value": "0a9ff99d3fe5dc9dd27d97bf1cbefa8ef535886a06b172f288a1fdb6af393b4d3e5f4433a08f400697b62fb708dc4c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767207, "uuid": "d9b1139e-4c39-43d9-9f6e-8f32c87fa2d8", "value": "T11A2733839E04A630D5611CFA375B6B9139BAB4306F408A87B3A46F369C3C7A17734E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767207, "uuid": "5494e391-b275-436f-8321-91a13f077a41", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767207, "uuid": "c7a7f0a7-32ee-4a6d-90ab-ed486ee19a89", "value": "393216:Vyyv/JNbIZNv1bLTMZN5GTRWTjzMPpDcFBxxkhwgA1LivT2ts+oKs6yCZZh:VLTcB1QZiTATjwZNuLivT2ts+oRCjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767207, "uuid": "3fe3f27a-bf73-4803-adf1-b575a7ce7dd6", "value": 20582462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767207, "uuid": "e39dc130-7ff3-4f83-a0db-f3ab2628f0c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767207, "uuid": "fef78ac8-2b56-4601-9297-77e78449addf", "value": "nixware crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49077e74-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628750043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750043, "uuid": "7abfff69-36ca-4f7e-bac8-061df74bc779", "comment": "Malware payload (Loki)", "value": "ad2bc9259c1e585d4f57ef642ba39761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750043, "uuid": "1b78be7f-0098-40a6-a11b-0dcdd828e1f1", "comment": "Malware payload (Loki)", "value": "10a9b096a58113207c7609d58e6e9b5c83e819357fe2dee6f92a02dc63b65d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750043, "uuid": "42ce28fb-23a3-47b5-98b3-1af550121325", "comment": "Malware payload (Loki)", "value": "4908cd9062033ff9754bb44524843ba1aecf2312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750043, "uuid": "ca8e2a5c-f688-4e37-81b9-dfa954b2c292", "comment": "Malware payload (Loki)", "value": "bec5fd05e19232dc54b4a41dbe61235470f20e67b28b0fa35d81a06a76cbdc4918497b9f87cd83fca6a7819ee58db3ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750043, "uuid": "49034c00-9536-480f-9fa5-40533183f025", "value": "T1AF55B33C29B92A27D176C375CBE59827F4409CAF3161BD94A4CA73660376B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750043, "uuid": "87278c45-1cc0-4051-b880-a03668351c8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750043, "uuid": "1784671e-9bdc-40d7-bcff-aca338f55732", "value": "12288:qwzYSMYbRnmb4yyaPwUfcYG9mCEnqIT2fXdk/HmUVpJ03EVinI:qYYS9Ri4t+1qIT2fXdvOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750043, "uuid": "cb7bc790-5b97-4348-9eeb-bf416c3fad0d", "value": 1360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750043, "uuid": "94e2596a-4a6d-4135-9f76-e1008ebc2c93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750043, "uuid": "9e32ee09-6464-4ed6-b5f6-98353b597fc8", "value": "ad2bc9259c1e585d4f57ef642ba39761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bea668-fb6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628772772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772772, "uuid": "1bf887a8-ed33-42c0-b128-2c9fec084788", "comment": "Malware payload (AgentTesla)", "value": "842f6d899d6463c3d3babd671d737b96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772772, "uuid": "5729c4d2-0eb2-4245-8bd9-7d737fdc5e7c", "comment": "Malware payload (AgentTesla)", "value": "10bb37c126b29223e5e1b8d5f074a4c5e60f4f2e0a46a07ffb4e7447a97ff957", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772772, "uuid": "49759bf7-dd84-41e3-aafe-7d62da50647e", "comment": "Malware payload (AgentTesla)", "value": "2daaf827ad38e9742b8c5ee6a3310117ae28c454", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772772, "uuid": "09e3f71d-3c80-4c1e-bb68-3e362cfaefc4", "comment": "Malware payload (AgentTesla)", "value": "f41080470a92a7302fd4808f6e5e43a61d2e2410da3eefac0db5253dabb392c26f9f931879ee31dbb7bd75621762fb16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772772, "uuid": "c4b69249-7a3b-48cf-8cbd-04a5113bd110", "value": "T14455803C59B92627CC69D774CAE19827B051BCAF3571BD9CA4CA73260373A5235C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772772, "uuid": "73f63189-ed9b-43b7-87aa-1ea0b48f446c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772772, "uuid": "98b04827-44a1-466e-a8b3-fe0ba23c3ba4", "value": "12288:qAQcUOu7Va0uGk792rVGGF1PM4/F1lN0BL1/KVem4tPqT2fXJ/:qAQcRuJa9WBF1PrL4L1/KYnqT2fX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628772772, "uuid": "d089910f-0e84-4c31-9e9d-aeafbe6f99ff", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628772772, "uuid": "23a0ed91-14c0-4e00-aacf-d09578217fd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772772, "uuid": "ea3517d4-7441-4436-91b3-6b932b357ae8", "value": "SPEC INDIA U2D1234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ad5e8f-fb6f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628774092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774092, "uuid": "c28387aa-18bd-400f-9cb1-ec1048fdb3cd", "comment": "Malware payload (AgentTesla)", "value": "9c449fe16940205d0799aa816c420b74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774092, "uuid": "5186c2f1-90fa-4d58-90e9-3905c639bfcc", "comment": "Malware payload (AgentTesla)", "value": "10f1adb9850bf8aabcefaebe019d8d8245ffd81bff8f4c2a6e578ffbe455f292", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774092, "uuid": "86182911-fca1-4f92-865c-c6772ef8acb9", "comment": "Malware payload (AgentTesla)", "value": "b982159539c553277dcd1a0b302b34848b6491b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774092, "uuid": "2fb0432e-47c5-435e-b8ac-1939b3358c11", "comment": "Malware payload (AgentTesla)", "value": "94277c35369ef4e231067e416833ba47035edd21d1270dfacc49170c583fdb5307c3c35a96472212c54d365086d976c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774092, "uuid": "d2a77a13-05bf-4d39-b5be-3d0f78191852", "value": "T1EA756D3D19B92637C0A5C6758AE18817F0409CAF31D1A9BC94D27F66C3F6A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774092, "uuid": "7ebfa941-d83d-45f0-b311-016796c4c032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774092, "uuid": "0b782339-cd71-455a-9751-fe086bc00812", "value": "24576:ntyl4yHZDb34NoNGffQaB3QXrw2857azil3ZZS5R0:nYpNGjB+0sGl33B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628774092, "uuid": "fe76f1a1-aa45-482e-86ce-86b3c2a5e567", "value": 1594880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628774092, "uuid": "1f525882-286b-48a5-b5f6-715366b7d8d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774092, "uuid": "4b5bfa6c-d68d-4353-9e59-e5fc8499c321", "value": "Payment Advice copy 00081212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782caa7b-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767731, "uuid": "ab28dc3d-547c-4a5e-ac7d-dca3749878c6", "comment": "Malware payload (Nitro)", "value": "fc140a218780fadbbcd7570fb7e6df3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767731, "uuid": "d661b29e-1194-412a-9984-4593685adfae", "comment": "Malware payload (Nitro)", "value": "1194aebc9a0016084f6966b07a171e4c62ce1b21580d177a876873641692ee13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767731, "uuid": "20680c2a-a4eb-48e8-a028-f5283a13d17d", "comment": "Malware payload (Nitro)", "value": "96b6e8c81f4c9b2e338bd5be3b538d759b9cca2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767731, "uuid": "e45b4da8-75ff-4d8f-9160-96759e2e4af8", "comment": "Malware payload (Nitro)", "value": "5bcb0599174ff0e3a7946c4b6d35d3b3ba19de3eb851a3a6d75296c99dc0a23e8919ccf3ef52c629ab6b1ceb028dabb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767731, "uuid": "2c11dc3e-39a4-47f7-8788-6e75f1fa3c76", "value": "T1065364286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767731, "uuid": "f5c2419c-e63d-4cdd-b8bd-0e7d1a928e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767731, "uuid": "36e442f1-5b08-4511-8125-f979b1d1ebc5", "value": "768:ZOucKn7n1JFDNANIU+/ovLDwUzc80gmq3oP/oDt:ZO2FDNAPjr/0O8/op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767731, "uuid": "61baff49-4fb2-4f6f-9497-626a0c0be2c6", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767731, "uuid": "96a3036f-a442-4685-b5a2-437fdfcc2bea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767731, "uuid": "5fe31abb-f64d-4429-b1ab-affe914abbe9", "value": "fc140a218780fadbbcd7570fb7e6df3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0fe5b1-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767687, "uuid": "3c58ac7c-d53c-4f17-bf79-0066420044ab", "comment": "Malware payload (Nitro)", "value": "e12bd6ae9c9fccb087b9e6261bef0ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767687, "uuid": "99a3c6c0-dafb-49f5-9802-97ee5b6d0f8f", "comment": "Malware payload (Nitro)", "value": "1198f7a8f6cc4f524fd18e90351d3a01d4f44607df66d42ece6745a72da50163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767687, "uuid": "1fd582ea-da1b-4e94-acf8-82cb73df0f40", "comment": "Malware payload (Nitro)", "value": "3b5938490a27dc000b536d750dc6115882203fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767687, "uuid": "fe6ba18e-fb76-49d7-b76b-53b22f77d192", "comment": "Malware payload (Nitro)", "value": "14f263d7b2a90314a514fb728881d26a2e37bdce77e8e73ca7d44db554c058ec7564ed0a1dc99c7f56487861c5ea73f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767687, "uuid": "2f735b3b-48ec-4700-b658-a8bf4373ddcd", "value": "T1A317A4181F62C728F7A842B490E71A683770DF3D155987DDD524BB7C3A62EAA8F90703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767687, "uuid": "de0aa2a7-6882-49d0-85ae-a11f2d6000c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767687, "uuid": "3bf7c335-3870-42b1-8429-10e5c96c41cf", "value": "1536:1KsefM9ZkiAPiHr/0O8/oFKa0Ortu81+uFT6qIotyuQ1yU9P1R4:3+M9ZkigIN8/oQxOrt71DF1IF1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767687, "uuid": "14fb4bf5-1415-4fab-80ff-74a38883fb9c", "value": 19386115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767687, "uuid": "b6feda88-48a7-4ecc-8bf6-90fa014559a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767687, "uuid": "e4992906-7e6a-456e-980f-1cea4a33f906", "value": "e12bd6ae9c9fccb087b9e6261bef0ed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02dc5ca-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628776388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776388, "uuid": "172ff0ec-014d-4d27-8446-67ce99a4b070", "comment": "Malware payload (CoinMiner)", "value": "bfa1eae4dbb897d44aed1a349d7b66eb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776388, "uuid": "93244556-19c1-41fb-bf09-98197036f55d", "comment": "Malware payload (CoinMiner)", "value": "1202993e02cafc378caaea494d97555457f72369b6b94fcfd0202a4cbdf8a9c8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776388, "uuid": "9a003980-dffd-46d3-9eed-7a63aebacd10", "comment": "Malware payload (CoinMiner)", "value": "af2895ea60efb8f7ab997b1dd9f958a0d881fc9a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776388, "uuid": "7895ed6c-3074-4c17-add5-5d4a499b2ba3", "comment": "Malware payload (CoinMiner)", "value": "497fbeabea56eeb144e8c949dce9fc6ed9c065c2b79ed32510685b4cebc0ab69c373f3e1f31873083e7dc350af86d933", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776388, "uuid": "dc4e771a-223d-41a8-bef1-b9e5514025f8", "value": "T165648D30BB90C035E6B611FC45BAA37CAA2D3E605B7450CF52E52AEE46346E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776388, "uuid": "a588fa88-ae5a-4856-8189-679b9b229a91", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776388, "uuid": "40d195a9-e145-4f2b-b418-7c4e5fdf0661", "value": "6144:4ZtihjxAr9wzI73e6csrftvw5ePm/hx8BsyR8lDN6Do:MihjCKzI73eMrftv1PG4D2lDNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776388, "uuid": "a3cfec51-da04-4184-8463-d7588cb95c44", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776388, "uuid": "8ece9bb4-878a-44bd-801d-fbe0f41c2212", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776388, "uuid": "a38bc3ae-2cc1-45a4-bc2c-55baaf5a68c0", "value": "bfa1eae4dbb897d44aed1a349d7b66eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa56e70-fb79-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SystemBC)", "timestamp": 1628778285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778285, "uuid": "e30375be-ef0f-4d47-a9c4-9ebc122c2279", "comment": "Malware payload (SystemBC)", "value": "8ed5f474476b8ac49a1ba0ac9222feae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778285, "uuid": "10327098-fa97-4595-96e3-b46048542f15", "comment": "Malware payload (SystemBC)", "value": "120fa0aa63598735bd316759edc1de341d089f391adf67b356039f1e706655e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778285, "uuid": "2c89330a-6d6a-44c0-a603-b180142fa1e8", "comment": "Malware payload (SystemBC)", "value": "19e127533f8b6ab97cad19c6e5e66c33d092360a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778285, "uuid": "f17140f3-4434-4cfa-a9f7-dab352d78883", "comment": "Malware payload (SystemBC)", "value": "8721b2923fe7caa06b412fd173fef66a222bdf5e0c63f055cebae95f3fa06078af43ff5d36fc3ad60ea3161a2055e1a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778285, "uuid": "35c86e5c-7e27-42bb-8136-6a453213a5ce", "value": "T12FE55C137248A43FC55B573A4477AA5C8C3B6660A987AC165BF10C4CDF353C22E3A6BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778285, "uuid": "fd00dece-90f7-4133-86e3-b03dc99a93d2", "value": "44237cdd4424ea55c5c96b9ac4c11268", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778285, "uuid": "ffc564d9-24ec-44b7-8ea5-8213642f88bb", "value": "24576:hbQ9TxD/areLtr0CboOCxJJgK9MNjDS5BYS7EY7EomsVjB1CxY4W3TGmsDA2hTE4:ZwFa6xRMO/S5iS40B1GY4W3vsDPTEx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628778285, "uuid": "e90d20dd-e7be-4ee0-840d-3396061df26e", "value": 3244032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628778285, "uuid": "adfbd518-df24-4b8a-a93d-a774284001fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778285, "uuid": "d7df84db-75c9-41ce-8f96-9601b13c0263", "value": "nv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5679578c-fbb6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628804611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628804611, "uuid": "ff087394-50dd-4e47-addb-4a9535244a29", "comment": "Malware payload", "value": "f209eba907a51025f1e60e14dac912b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628804611, "uuid": "abe02329-d6ad-4450-aba3-5cd77ca75e7c", "comment": "Malware payload", "value": "12505bb6e3c63202f22db1d60afd4a0a386ddff8807bf0d1f8583ba57f6413ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628804611, "uuid": "8836e224-92fc-45aa-8ca4-72b14a427657", "comment": "Malware payload", "value": "dd893b9807623a3ec3c74f921f1003e0853ab8ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628804611, "uuid": "9289e8fc-e337-4df0-8fc8-83932a36910f", "comment": "Malware payload", "value": "4883f806222c69048bec5575b5ade9c8c027c608aae63f21c547b5a9c3005264a837d5809a712d80f9d9636d979119b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628804611, "uuid": "dcb64a42-016e-40d2-a51e-be67860a273d", "value": "T169C512D930CAB89FF3424C31EB1388517004EE17D7B78175791FFBDAAAB9570861688A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628804611, "uuid": "4620a6eb-a73a-4906-9e32-1a1186520618", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628804611, "uuid": "d917819b-a77d-4503-be96-2a8fd71fe868", "value": "49152:MrQjrFqvDtFTlUkYlhI/FSNpv7/d6gqtaujFwaEsM0KuVXiiku9dw:OrtFTlohIYv7F6gqtNjF1PRVv9dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628804611, "uuid": "db58989f-cb5b-4d71-9fac-1dc4079dd819", "value": 2627416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628804611, "uuid": "a26c6ecd-41c8-476d-9ca4-956012d7a4da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628804611, "uuid": "7ba50b96-426b-49b8-b2b8-7db40f7377a5", "value": "Syndicat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02158c7b-fb57-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628763668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763668, "uuid": "4ca6489d-ea99-428c-b964-c22c30ba4d0e", "comment": "Malware payload (Formbook)", "value": "4b7da6e31b0c449f0dca6530530774af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763668, "uuid": "6dae0883-5d11-4290-8496-4d8faebbe9c7", "comment": "Malware payload (Formbook)", "value": "132167fd6c334c13919991a82a38645572a9d58c5f83cb1ddf0fcf41e37d2105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763668, "uuid": "91f8912b-851d-4a42-8d70-75402a1ca88b", "comment": "Malware payload (Formbook)", "value": "9a5b346819b8ca408f0cb42ea9606e6dbaf4c3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763668, "uuid": "f40a2911-88b6-4169-84df-708a734326ad", "comment": "Malware payload (Formbook)", "value": "533214285c28a2ee4d7a4e4a2dc0994d79e8a71ab5eef6c9aa65f7871c8f400e22d48aec0c689eabc25c72b50f8ea5ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763668, "uuid": "b6ce5c5d-b16d-4d17-a642-f538ad670624", "value": "T118754A3D19B92637C0A5C6758AE18817F0449CAF31D1A9BC94C67F66C3F2A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763668, "uuid": "9b82fda6-66a7-4ba2-8d56-ddfd043a835a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763668, "uuid": "6fc4b72d-9411-41c5-8761-b9123c6580d8", "value": "12288:kxVCRNh1fVEwB3ekCkrI6V7aQhP2VcP5cX+uQ6H+Uy1Susr8MmH3ju:8mh1fVEe3ekhIuGyPMcHDZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628763668, "uuid": "f479828d-1c6e-41b0-ba49-c2f43acfa602", "value": 1549824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628763668, "uuid": "daa24517-7076-4901-a872-7b92b4ddada1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763668, "uuid": "e5e0d08d-60a4-4a37-bdab-24b48dd85858", "value": "Pending DHL Shipment Notification REF 81121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c99c67-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767209, "uuid": "0cab49ed-2086-4e62-bba6-4119a6b65757", "comment": "Malware payload (Nitro)", "value": "91bf08cf3b4fe7ba828029921022dd8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767209, "uuid": "5e594b7b-4919-4551-b3f4-533b11c0ff0d", "comment": "Malware payload (Nitro)", "value": "132892856b1e2340493308a9f68eea81a391db0e161422cca6de72549ae794ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767209, "uuid": "830389ee-d06e-4ae3-89e1-151203db6e50", "comment": "Malware payload (Nitro)", "value": "4cd4c9a43e488a795b044b4b3e0da35bbe197002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767209, "uuid": "5365b6c0-b813-4377-919a-27e4193a80b0", "comment": "Malware payload (Nitro)", "value": "4fc6bfc3400aa0adcade5ffcd8171ff3f59bc3b745d479eab665119ad2635af626219fca16abb5f59788b8ddebcea44c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767209, "uuid": "438efb68-ae7b-454f-8e2c-c3e913145196", "value": "T14053542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3E277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767209, "uuid": "b9e195f1-574f-4d16-8485-a1e761e3ae2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767209, "uuid": "f835960c-a525-4031-9a2f-21f326ee5db2", "value": "768:tKsMqCXfVcWp3M9ZkiANIU1UJHYLDwUzc80gmq3oP/oDh:tKse1M9ZkiAPWWr/0O8/oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767209, "uuid": "045f83a0-2457-4ade-8ade-476795ce2b32", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767209, "uuid": "2c4245c0-6d32-4b9f-94c1-e8d1a5fa40bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767209, "uuid": "aee151cd-3e8b-4b64-adff-360d6f21a36e", "value": "91bf08cf3b4fe7ba828029921022dd8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab3d42c-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767252, "uuid": "e0e1487f-6b7c-40e3-85b5-0e5290d7dc89", "comment": "Malware payload (Nitro)", "value": "227a73d24f797b6ddc724f54992f05ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767252, "uuid": "e60910b3-5a1a-4270-9a66-058174b4f2d0", "comment": "Malware payload (Nitro)", "value": "13c62078b17609a57ecdf9c64e3f16fcfdac866ca58c7929326a260ccdef76b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767252, "uuid": "0e2e85a3-9643-424e-866c-1d2f6ffaea2d", "comment": "Malware payload (Nitro)", "value": "05d43fa2e84bfbf14e74256b65f3070fdf640e02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767252, "uuid": "a27c0faf-088f-419a-b4af-d5f91b928357", "comment": "Malware payload (Nitro)", "value": "04311390bdcaaf9a62b5c7c4c7df7debddcaad50f1a9840b507953c4338c957ea2f405961eb7ea8248734a0c45e8d785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767252, "uuid": "e70a1666-8225-4d7b-a52c-d678861d4709", "value": "T1BA53752851B3862DC87C96B411EB2FBC27B0AF165460C76D4A78D2AC3F277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767252, "uuid": "e0721e36-ac94-4771-8da0-dcddb1700c22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767252, "uuid": "168633b7-e32b-4a9d-ab03-fb6f192c9a3f", "value": "768:UiXcvIVLDwUzc8Ugmq3oP/oDzayoiT8WldZtUn3Ahui:UQr/UO8/oCTmVl1U8ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767252, "uuid": "d63d899f-77d6-4747-9750-0ecb17dbdbcf", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767252, "uuid": "ac62aac5-7550-4cb3-b088-9d89bc69d96f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767252, "uuid": "0ab56373-445a-443a-889b-8ba831b25d77", "value": "227a73d24f797b6ddc724f54992f05ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a28926f-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628766875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766875, "uuid": "1749aa7d-757b-46da-8235-6ae1651089e4", "comment": "Malware payload", "value": "4aca45aef45877ffd73b07a5f96b1e8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766875, "uuid": "81aa2151-f858-438d-80da-7b16b11d1e86", "comment": "Malware payload", "value": "13e77dfdb636aec9bcca1f518ed0b49830fabfa2022bfe024962baf89caf9e19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766875, "uuid": "91fbd911-8929-4fe0-a9cd-ded6cf934ba6", "comment": "Malware payload", "value": "878f9455d274214cc0a194e9705067ed9a9c93b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766875, "uuid": "6f96faa9-5416-4e3e-a6e8-45d3ee6813b7", "comment": "Malware payload", "value": "d122878c226a8dd13f5196031016a22152e9ffa7faea17fc0342394b600e03cac30f4a77241b04e4c6db153df7480c5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766875, "uuid": "fe395c79-63e6-4f77-83e5-8b740977d834", "value": "T10E347C28B7C29FB2CE164FF7416352215A32E1527FC2E79F7DE02FC858896CD4056A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766875, "uuid": "ac0fb219-56d6-4f97-9a15-2049d16476db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766875, "uuid": "0c047214-9ce3-4085-b6a6-21a8264f9a86", "value": "6144:XYp5N0bMePQ0TVf+ByYEq02PjGPJmK7OtWOpiUmme7b2LCGPFb:MQq0mjGB9rUmNqOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766875, "uuid": "9cddd899-baba-4d5c-8e22-74acba417476", "value": 245280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766875, "uuid": "daa129e6-21dd-4e5b-96ff-6cb96d909dd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766875, "uuid": "af699e24-3b03-453d-8f85-e6754b37fd8f", "value": "4aca45aef45877ffd73b07a5f96b1e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12613de9-fb30-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1628746945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746945, "uuid": "c1dd86e7-3c3b-40dd-aa0a-35f0988d7223", "comment": "Malware payload (RevCodeRAT)", "value": "bcb77b64ef4a369f8b381aff4c6f1c57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746945, "uuid": "44b391d4-ad26-4ff7-9f91-5035e41b9dbe", "comment": "Malware payload (RevCodeRAT)", "value": "142cf7f01ff7c99da5e16196325e3fa3a6d867ff0e50696d727c92696ba97ccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746945, "uuid": "5355f9d1-7279-4612-ac28-16a910c5a876", "comment": "Malware payload (RevCodeRAT)", "value": "4624958cd8a724ad01868331d9a78a64fb0cdcb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746945, "uuid": "245b2522-92fc-472c-8fcd-55d70eff4e79", "comment": "Malware payload (RevCodeRAT)", "value": "677e364fae4c6b0219e6190838271bca2de0e05d86890785151961f040d73b8fdae74bf62fa81254806672cbbe1837a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746945, "uuid": "2cc147e8-de97-4bb5-883d-ba95126e101a", "value": "T1FC25129C07A2CB4AE0830F75DC8385F0FA5B5E14A6D7D18785D1AA8915BCB2EE7214CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746945, "uuid": "c353e842-275f-45e8-aa36-71b7107f9753", "value": "48cf05311e4a3e8be7b754cbebbc2209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746945, "uuid": "ae75c2ff-0323-4135-bd59-f16448b927ea", "value": "24576:kkirwmPnCRldoDbhC8xyhFOKOl0TWfNBBx6xs30LM:kxrwmPnCS/TxAFOX+TYwxk0LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628746945, "uuid": "8e77f904-e807-428c-bf06-4f182ab87b9c", "value": 1006049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628746945, "uuid": "9bbab4e2-fd91-4002-84ca-65849cd97b22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746945, "uuid": "07f8a98a-05a9-4827-8dca-bd31d5f641a6", "value": "NEW PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da4a1db-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767203, "uuid": "0cce5068-8873-42c8-9003-351c4a4a33bd", "comment": "Malware payload (Nitro)", "value": "89fbfa647b0558f766bee4029fe66187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767203, "uuid": "a176b571-da85-4366-8cd7-dee9c24b308b", "comment": "Malware payload (Nitro)", "value": "155e6b0ba6cc29659970f69c00034f7b591e8f63c4727a12c64f13f7543421e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767203, "uuid": "f3909294-5cfd-4614-a397-ea1103335812", "comment": "Malware payload (Nitro)", "value": "72260bdc557b500d3c4c13d8f1228c0b49c5ae95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767203, "uuid": "730cb13b-b8c5-4967-a27a-8ca4b32d1e58", "comment": "Malware payload (Nitro)", "value": "78c8bfafcc0e40e9016aaf89876a632a5cb4bcdc94080a5c10dd7db02797b416dd29081744c49e81abc215a1a9f55535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767203, "uuid": "5d0d88f1-a545-4b9b-8e39-fdc7d5c9340b", "value": "T1F253542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767203, "uuid": "d3ac07af-9ab3-405d-9350-f9a034729a07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767203, "uuid": "26103194-23f0-4500-bab7-57c506a21b9e", "value": "768:TKsMqCXfVcW4M7M9ZkiANIUa/YLDwUzc80gmq3oP/oDm:TKse4IM9ZkiAPtr/0O8/oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767203, "uuid": "77255e84-b1e4-4bc1-968f-94fa77bab300", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767203, "uuid": "4b9e6b01-3c1b-44c1-badc-d7f1bd084003", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767203, "uuid": "db55a513-1fa3-4312-890a-065ac1e4fbb3", "value": "89fbfa647b0558f766bee4029fe66187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dc2a2a-fb36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749605, "uuid": "ce7b3c1a-8211-4602-a8a6-0bd4ec98b18e", "comment": "Malware payload (AgentTesla)", "value": "64253fd4e6eb267b6ec4e814112928d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749605, "uuid": "0b5d8393-ace2-42c7-a670-75cbc559880a", "comment": "Malware payload (AgentTesla)", "value": "15ee5a319fdeaafd781e768c7df3df07ff1e4d55b57eb5d8e88c887409b76106", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749605, "uuid": "77ae6e11-d6c8-436c-ae71-09f888554a8a", "comment": "Malware payload (AgentTesla)", "value": "15b36831ec288c00eb375f6f3c14fa3332415377", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749605, "uuid": "5aa63ecb-f3e8-4d6f-87ed-5a1829db73fc", "comment": "Malware payload (AgentTesla)", "value": "cfd99008b1fd8db0f64b309d6796102ddb079e3da34e6598f1335c10efea474291aa1f8070796a08b830359b1f1d633d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749605, "uuid": "4c08a73f-c88d-4325-9b71-05338c0396b9", "value": "T1C0E402B236CC4E5BC5586A781695204353FAA2596342FB9CFFC6E0F50BCFB940B70A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749605, "uuid": "a6eb039a-2a18-4e22-88b0-a2d7991abdef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749605, "uuid": "433e5b97-b220-4dec-8b92-b52480961647", "value": "12288:GmK+/HK7zWHotY9HPG5TqmYJtn8ADNyjJOmdNuUGhP1FmBbDaGMZhbPpTvM:QGPsTSvn8UNyjJOmT3Q4DYXPpTvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749605, "uuid": "10550d88-06d0-41cc-af27-119fb17a0e01", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749605, "uuid": "c96d9822-1e28-48a3-ab13-2ca798235c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749605, "uuid": "6236057c-cff0-420b-b5f5-c1898fbd0be6", "value": "Transferencia_10744399.PDF_______________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d99170-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628749093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749093, "uuid": "97811fa8-386f-4991-86e5-6b65cae50700", "comment": "Malware payload (Formbook)", "value": "168e2fa04e53f90c0d627a1c69895c18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749093, "uuid": "40e4229f-b2c6-4514-b32d-7cfcb07a6529", "comment": "Malware payload (Formbook)", "value": "161c19241ddafd727fcbb633016ae5032481b68032bd0103f174d2e7bbecc0d4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749093, "uuid": "efc3be36-4c66-43bd-988a-b34845214066", "comment": "Malware payload (Formbook)", "value": "7fddab8e3bd14361b4863af707042ee3aee6b431", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749093, "uuid": "8bd1b078-d83e-4083-804d-798691a1a4be", "comment": "Malware payload (Formbook)", "value": "7af84c750279f56e541aaee43e93122a1891fe0488b01602f4eb93bfd016fd5ae18c677d0d3f9fa322c3edb54d69c81f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749093, "uuid": "da5385da-bdcd-4a3c-ab71-d8d401cb80d5", "value": "T130E394ACC85302988F49ABB82B1B1F85118CBBADF7459533727C577857D1C3E942287D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749093, "uuid": "598191e6-307b-4940-9a48-a1e024ed0192", "value": "384:XmCr3NXPTnwxbNyYjsQDuprBaProcSHtqZQjQ9Gw5:XmCr3NXPTnw/ySDuDd8qj05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749093, "uuid": "f977e5c8-4f54-44ef-818d-741f3c59fdd9", "value": 147597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749093, "uuid": "ed756c4b-545e-4bca-923e-04ba141b6002", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749093, "uuid": "86186aeb-dfd3-46bb-a3fc-47d89d931ba8", "value": "Qtn KWE116167-21 AMAT RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b6549f-fb47-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628757154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757154, "uuid": "9208efef-3ed8-4048-84c0-c77a01ad3a18", "comment": "Malware payload (AgentTesla)", "value": "055c7b3bb4cfdc848302fc355b283bdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757154, "uuid": "4dec485b-3f82-4b78-b98f-22d31eca8b85", "comment": "Malware payload (AgentTesla)", "value": "166bc7ce7a1d7395985340613e88e3058aa277a37b2079ff6c3bde6d3992a141", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757154, "uuid": "54c3d592-1d65-4a34-a0cc-f3c1d1ffbfb8", "comment": "Malware payload (AgentTesla)", "value": "3dfdd9c427551cd934925384dd80f64b88176c6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757154, "uuid": "e2c34f2e-80a5-4065-88e1-49f51b5cd06e", "comment": "Malware payload (AgentTesla)", "value": "916f7e2dbb1eddaeef2d8b5c4f8026bfd511de223ce6a2c2c4c74186beb7d9e562a7348f0ae258c9f6abd49c312e2190", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757154, "uuid": "d2526a94-2228-4c87-a1bc-93c1acdb20ff", "value": "T17564F1AA72D5C135E876213000A895B3DD2DFD304DBFDD7BA384562B5B282D09A35E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757154, "uuid": "834b96ee-8038-4c33-9da8-3d77cbe48cd9", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757154, "uuid": "d75afbae-8022-4b80-9e1c-dbaf18f8af16", "value": "6144:kLfRiOnGUcvnRFRInVG8ALNIRzjtHBZwIxFXAvNaqivUXAiicBS:kLfR/kNMAOJCIHAvNxiv7iisS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757154, "uuid": "a79ee08a-c59e-4ccf-9955-7bb7fef048c4", "value": 306559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757154, "uuid": "17d01c6b-4939-4758-9c60-9ea11b8dbb81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757154, "uuid": "fc58341d-493a-4846-bd21-2d095e815eec", "value": "055c7b3bb4cfdc848302fc355b283bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4939d0a-fbb2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628803105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628803105, "uuid": "d36e082b-278c-4782-9627-e8c7fa295f8c", "comment": "Malware payload", "value": "d973b4acb8605075c0232164cee1cf0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628803105, "uuid": "f0a36ada-370f-4e8b-99b5-5f8e9408be56", "comment": "Malware payload", "value": "1671d437c495b0484bc9c1623aa7ed3707f407214763294e875870698dee8da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628803105, "uuid": "b824b275-d273-40e1-ae54-4b4175739596", "comment": "Malware payload", "value": "492f3465da09ad2995ef52f204207fa39f6e7592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628803105, "uuid": "8b0693fa-abb4-42ea-ae16-d9ed666f9cec", "comment": "Malware payload", "value": "6719939c19e529b341c7ce55e44ab49b9e6ec95bf207bb7d2614f05e4ff3d6a42ec2396eb32719bd32647f66d8f20429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628803105, "uuid": "1e50efb9-d26c-44a5-8a52-96fd55f55b53", "value": "T107C2291877E08620C7FD5B770C63A111037AEE47D513EE1E4AE0E4F91A7B2858B50FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628803105, "uuid": "e63769a8-a1d4-45f1-95f4-fce99d370373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628803105, "uuid": "682b7dc4-980e-402b-b257-c34ad6fb3862", "value": "384:VXPSQEGNFBmILNk49jGFQabkjj0FjAWWdiG56pK+Z4lp6NaUkipd7ag6b0mLA8sh:lO+FEISCabEcsWo5WK+ZQ0Mb0rM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628803105, "uuid": "f0b5f2d4-28c5-463d-a78b-c6d924811f3c", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628803105, "uuid": "5ce2de0a-86fc-474d-90ec-2cd354e746d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628803105, "uuid": "851c0869-f829-4317-9d29-d771e4bfc038", "value": "blackhatworm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8838048a-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628749290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749290, "uuid": "025a9099-1cb1-44af-9ef8-1d83022ff5fe", "comment": "Malware payload (Formbook)", "value": "4477ac8fe00b8369d10d7db025c80b1b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749290, "uuid": "7a2f97a8-4a65-4429-ae08-8d2cb5914075", "comment": "Malware payload (Formbook)", "value": "16c5457962d91a0862bea7412afd8d6b059141a5184c40ec50dd35977f7651a3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749290, "uuid": "aa0c28a4-6143-47c9-a7b6-983d5ea52903", "comment": "Malware payload (Formbook)", "value": "e8f6dd4cbb2aff7e70a31cec4b87fd97384de809", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749290, "uuid": "fdc36554-cdb3-4af1-a51d-245a056a29dd", "comment": "Malware payload (Formbook)", "value": "92d3f05b7c41228fc0288cf8cd106f89e3ad7656ce71d7ede1d5bfd1f6cd58d6aa4639ab32128d66f807e1a85232ceb1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749290, "uuid": "ce173ab3-a558-48cb-8271-0d926e2e8bce", "value": "T1F6552306368C8BF2F38D317D3C66BF6949F19D8511A0A71EB29C353431BC4A89EC9796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749290, "uuid": "8b1a563c-df0a-4c89-8a8f-9d89309d73d6", "value": "24576:gkVTFqHijyAsAdTfJu9nF0VpYnRyeGOdyAsRJD5DTJ6y7K58mBS1y:ZTFq9pAdQ9GeRyeGOdsRHTwpaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749290, "uuid": "becae99c-9bc4-48e4-8dfb-2dcd8672f660", "value": 1339928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749290, "uuid": "2ed88f7a-847c-4d0c-9931-239d2de2e205", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749290, "uuid": "ccbcf6a2-77d7-4163-bb3a-c2bbd13f74c9", "value": "RFQ-2021-22692.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df3527b-fb95-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628790424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790424, "uuid": "b769242d-535e-4f07-b0eb-5c249a06595a", "comment": "Malware payload (TrickBot)", "value": "f0588e538f9353ff1bd1034f75137fd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790424, "uuid": "524fdc53-0cf5-426d-8bae-85756f079779", "comment": "Malware payload (TrickBot)", "value": "1733d9d0d3209761d0c803351b1fbcd77229c543afd4031c14af2e2bec522fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790424, "uuid": "d2d52690-34d1-4b53-b620-d6c82636f240", "comment": "Malware payload (TrickBot)", "value": "9ec2ce0230ed771c86a75f3bbd375e79c1ce2455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790424, "uuid": "75050464-8df2-4071-97ad-97ce4a88f3a5", "comment": "Malware payload (TrickBot)", "value": "c3e3e5edfb5c2c57a32f40c753912d229c7e899997eac03b27e74a670ac5b4cec5491d0ba59818e5acde3d31b6e4067b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790424, "uuid": "12e103cf-648e-4d9e-842d-0fe536a051e6", "value": "T14B74023631A4A075C49A0637442AC366CAAEBD56F071454B6FE03DED7FB22D00F3A369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790424, "uuid": "8b52d12e-40ca-4141-8cfb-0d0641d54021", "value": "14a81b46e8257bea317d97931d356cc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790424, "uuid": "3287d4df-05c7-45a4-a01a-57c43f26852d", "value": "6144:ZKFg9QEvAr0KKmFfZ/DBk4aWTl1Qlrtw8919yOJ1Nx:Zs6dYr0KKcZ/DBbpClRIAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628790424, "uuid": "9abd43e4-efd2-4328-84c7-b71a280fbef1", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628790424, "uuid": "2d9f037f-d33a-4c11-a4d8-406ce8c9e67a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790424, "uuid": "64ad314d-22ea-484c-a95d-3e1d6ad889c4", "value": "f0588e538f9353ff1bd1034f75137fd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad28d99-fba3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628796727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628796727, "uuid": "a4a052de-3715-4375-ba2d-9ddc70ab069b", "comment": "Malware payload", "value": "a36b4d2566935944f7281dae1be18d5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628796727, "uuid": "e3ea5cda-55e4-4efa-b536-0fbfadc45f67", "comment": "Malware payload", "value": "1753f2373b77f90cf8c6b94fbe533bdf25ec3415eebd88e5fadbe8bdc1137dab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628796727, "uuid": "01ad080f-21da-4aed-b47b-d9dc818daa62", "comment": "Malware payload", "value": "99614adc5398197253c3dd931de1ffd5c431ad19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628796727, "uuid": "2b6df72d-8924-4de4-95a1-022abfd2a6d3", "comment": "Malware payload", "value": "423edfaed0917b89ba517a75c495cf310a099084b3664e2d2badc4f3deba571eca011919159e475084f6b531e9d621c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628796727, "uuid": "8fde0bc8-2b4a-4f14-a754-ae2fde46ba98", "value": "T114755B3D19B92637C0A5C6758AE18817F0409CAF31D1A9BC94D67F66C3F2A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628796727, "uuid": "cc2d12d5-f9dd-4542-bddf-4e13030e92d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628796727, "uuid": "06342012-0b50-4d99-bfcb-8fdf706802c1", "value": "12288:yGILfI/4e0qcYf/4Y14YXw6k9Flp524ztx7XpqCVXh77lAOH3Q6H+Uy1Susr8Mmh:2Le0qcKAY+b1PpvVI/ZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628796727, "uuid": "28e6b575-4263-4235-aaae-c5aeb5d4f233", "value": 1578496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628796727, "uuid": "19865ccd-fd5b-4f91-b161-eb13211e5836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628796727, "uuid": "59823465-4ffb-4ec5-8da7-549d290a1a03", "value": "a36b4d2566935944f7281dae1be18d5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec42f2b-fb32-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628748120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748120, "uuid": "5f163436-5d9e-4db7-a6cc-150aeb2405e2", "comment": "Malware payload (Formbook)", "value": "2b60409d0b8a3e063cb2292e9b09c072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748120, "uuid": "7f7c8919-f498-4752-9fd5-683af5c79892", "comment": "Malware payload (Formbook)", "value": "18b7d102ed7c43b96306fcf3616a4e96add77a7d2c55296dd059f974ef8ddcf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748120, "uuid": "1dfddb73-f5a1-4fcd-a29d-3f7c4f425057", "comment": "Malware payload (Formbook)", "value": "4693437d5c29099d69e26f794a312fb475155cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748120, "uuid": "9838b3f9-4e3d-45a1-8847-657108082799", "comment": "Malware payload (Formbook)", "value": "623de7cc65ceb2ea02c8e5b916cc114ab01f9198cb541db71e16082c8f365a214ae1da28f63a4fd7cef997f7b6981c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748120, "uuid": "cdde9340-37d4-4354-a503-ae58a5b5b4c4", "value": "T1CE05CF9D32A076EFD857C972CA641C60EBA5B4B7871BC247901705ADDE0E98BCF106F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748120, "uuid": "8baf60b6-3536-4c22-9d4a-03b5fe662ea8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748120, "uuid": "213ebb29-8b75-45b6-8b56-aa65902df086", "value": "12288:T/HK7z5v0rzv23iNLnKZYn18ue2A78LZC5bhe8UZt4UbRZ4JDk8JOYMUWXb5pQVQ:udvd3iN0YOuhAgeb48UjBdS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748120, "uuid": "b234f96a-3a12-4161-b7c5-43e581b3f1a5", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748120, "uuid": "dc58ab90-f9cb-4b13-93ec-cd185c7a3ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748120, "uuid": "a8f53aa1-e0ef-476f-9946-f8419e4e7705", "value": "Transfer application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad61aa8-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628775950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775950, "uuid": "635c3a81-44ae-4fa5-8a15-e62096aa1f7c", "comment": "Malware payload (Formbook)", "value": "a2d3d2e36c8715c731dce67be0095659", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775950, "uuid": "4df7c662-a7a7-44a7-a629-39d9fcb01f61", "comment": "Malware payload (Formbook)", "value": "1996741af1a85dacb7bf48a95b7d87cac963c97ad573ba54c06fc4ad0c08ae94", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775950, "uuid": "2dc79cb0-096e-47af-b65b-6d9266c3d932", "comment": "Malware payload (Formbook)", "value": "10af1fbdbca7a4a6783e46eea2ef786659c9aac6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775950, "uuid": "dd107aee-083e-4cf5-8930-d719bedddfa6", "comment": "Malware payload (Formbook)", "value": "5b0386137db1bd474934e71a5badb5c63df7851d68d393bb151c9112940e37ceaf9aa84f139caef3a8118a9c65b1347f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775950, "uuid": "9708ddc7-728d-4f27-9ccb-42155e9cd3b4", "value": "T160451303F966E7B3FE6D47B9256686A70317BC442AB1540F2B0BBE1239F49D209C63C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775950, "uuid": "053fc369-7a0d-4ff4-b89f-95fe94397a81", "value": "24576:DKq/hBgEM//+keKMJJOxnq5PrpoiG1bi2zUZ4oEsIKyCCOmFviJdq9jyz:+q/oZ+keriq5builPKrfveM9jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775950, "uuid": "464d0a1b-ccd0-4a2c-8b0b-bfe065980f66", "value": 1222792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775950, "uuid": "66086e4d-170f-4c00-af90-bf9b31c6c0df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775950, "uuid": "0ac88c72-125c-4eb6-8257-df7f2ba0d856", "value": "SKM_C3350191107102300.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa47876-fb54-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628762804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762804, "uuid": "8f11f8d6-0c57-43e6-a13c-ac00e51d95fc", "comment": "Malware payload (Formbook)", "value": "2ea57e03a2e9da369e190a028d159045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762804, "uuid": "f5df762e-37e9-4dea-8d71-547d9078d9fb", "comment": "Malware payload (Formbook)", "value": "19b682f4983833b4f3670a22763a06cad7476076ea99a6800e7dbc8732431fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762804, "uuid": "0789b5ba-bb67-4c96-9267-66e575b2a89f", "comment": "Malware payload (Formbook)", "value": "a367485284f0f3399f6f3f8a8649ff27d72271be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762804, "uuid": "a68350ae-8706-4fc2-86b3-5457ec24ff6a", "comment": "Malware payload (Formbook)", "value": "819a0c18ebe1962de14ef71b3f9cf3d57393d37c0917ed49f9aa7ab161cc750ee69f21339a4bf06602a7f567465f368e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762804, "uuid": "ccd69df4-50e1-4899-91bd-7e691ee23061", "value": "T1FD65E63D29BA2627D07AC375CBE59827F4509CAF3151BD94A4CA73660372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762804, "uuid": "30ff49ff-eaf4-42bc-a97a-8d18892f6c9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762804, "uuid": "b4aba958-627b-49a6-a21b-b331220e68f3", "value": "24576:tggDThVH+3nPxT6f5MBzhfyUTAXVNT2fXdvO9:ugR1+3nPF6m3fulNT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628762804, "uuid": "7820b65c-5721-4a29-a1d2-d4a10bba5142", "value": 1479680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628762804, "uuid": "296ec56f-cc7d-4f90-a149-7d24386b9e78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762804, "uuid": "f1ddb1e4-5f1a-4806-ad22-d018934d7e2f", "value": "Doc_11082021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc876d8-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Adwind)", "timestamp": 1628749195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749195, "uuid": "e7e78dc6-e681-4324-90ec-d2a297408420", "comment": "Malware payload (Adwind)", "value": "a26a4bd2586d13bca78597254180bf01", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749195, "uuid": "29897930-a9ca-4d02-a8f0-70744a4f4470", "comment": "Malware payload (Adwind)", "value": "1a4cd5bbbbd14dd406a54082778e8da2cbcea83e04fa05957f345daedaa5f7dd", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749195, "uuid": "f7ed7303-9e4e-4232-b749-07982dd3d4b2", "comment": "Malware payload (Adwind)", "value": "911e9e29caa44600f547e26d94c98c61c94d2c16", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749195, "uuid": "fac26aea-8184-4f9b-b28c-6b822810c043", "comment": "Malware payload (Adwind)", "value": "1a47c0a513537f822d02f954d295cd27ab34d88bb88d1fd24003eff197f0ff01a4aaecd0734bb4801f5cfc9fe6800b0a", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749195, "uuid": "16e315b4-7d4e-4db3-82ce-9f455d4e255d", "value": "T1B325AECC86840B5AAEB4900F06EF5BE783E2E9492401D0CB46771F9FEB17A791537678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749195, "uuid": "eb19e4a4-c0a7-4544-95b2-e8c6fc17a61f", "value": "12288:28feM/AN7advmjFB6fsAp/cdeZLSNklJTTGzMj/PgU8qcS:28CNmdvmXSpwuGM7wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749195, "uuid": "b4fcbdce-1661-41c3-9ee6-bcb2d4348b85", "value": 1005692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749195, "uuid": "0a4053b6-121d-48b8-8f3e-a53d16102e3f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749195, "uuid": "b30ee362-315a-4966-ab56-2fae51ecb4a3", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393eaed3-fb31-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628747439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747439, "uuid": "5ea01491-759b-483a-bdb1-06d7827e50de", "comment": "Malware payload (Formbook)", "value": "c2927f706f2fc5d37767de3f40c8671b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747439, "uuid": "d505175f-439d-4f89-b8c6-d4d300dbfb35", "comment": "Malware payload (Formbook)", "value": "1a55fa78a001127ab3e53317fc29487b57343034496594949610a78191156519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747439, "uuid": "b6c6626f-86e0-4dca-ada5-de3d43efa7b7", "comment": "Malware payload (Formbook)", "value": "457a0cbf5058152f04bcf018534646bbce2b5646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747439, "uuid": "b24d690c-29ea-418e-9b3c-5732c2af16af", "comment": "Malware payload (Formbook)", "value": "6543507c78db4db8b838254647b49488db38af0d03daf7dfd0e0ab2247efb1dc05f88a4b34c306b7eb43425f9b711400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747439, "uuid": "9c63e8a8-bccd-4819-9d9a-eb622f2b2d0a", "value": "T107D4DF3717887BF3D2BC87796866201583F0C12AA57AEB9B3CF561D44C5DF880B22657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747439, "uuid": "d199995b-69df-465f-9721-fe1cc663a71f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747439, "uuid": "e762bbe0-8c0a-4f04-98f8-f7d1dbb0c325", "value": "12288:xMz3Zg6g2zuXCzXDUO03kdwTYDHiwngDa2mYj:xM766g2qSzzRDLnD2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628747439, "uuid": "a7f9cfd9-839a-47af-af90-c756707025a1", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628747439, "uuid": "0d12ee14-39d3-41cc-8711-5f1ef5897a1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747439, "uuid": "6c5f2475-b5db-4852-830a-a73ae82cea2a", "value": "bnh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe2737e-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628749484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749484, "uuid": "e6d85c58-1200-461f-8030-7d37df477366", "comment": "Malware payload (Formbook)", "value": "6463b012efcf8e4ad74aaa9ad3e07921", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749484, "uuid": "e24025a6-1806-4b2c-8dd1-7c2b16e4967c", "comment": "Malware payload (Formbook)", "value": "1b496958300a292394001bcf659e0e73ed84fe3fac0cfbddaf93360cb9b28644", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749484, "uuid": "139e9cb7-dda0-47f2-bba0-3af8ec5af6dd", "comment": "Malware payload (Formbook)", "value": "d058330aa2b8db3e2d796d9ea5a85a62db4d9d77", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749484, "uuid": "d01262e2-8a3b-4dce-9fb1-8e3faa27bc27", "comment": "Malware payload (Formbook)", "value": "73c96f0d284860472457c72db2df9d22b5648ab395cc1b9290cd806b775e1067328f0a92e9caecb67e15d788b246dccd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749484, "uuid": "f84fed37-92e8-465d-a022-10b1c8b81d28", "value": "T14CE423957FBBDE3315281975C0CD702A393D9D22CE37A8141B18E63FAFA12D9AD1684C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749484, "uuid": "07c1662d-28c8-463f-a98a-27083a08651d", "value": "12288:wa8EsJqduHJojcroAMrQegV7tYiVoDcB851cZ3qZCPND:wLzqdvSDzbS1i3ZP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749484, "uuid": "a89f0528-cd0d-4e45-980e-59c9ce152351", "value": 671508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749484, "uuid": "60cfdd80-b4ef-4845-8924-c03da01e8576", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749484, "uuid": "03f5226e-fe40-4e6b-b939-01d04d6ee3bc", "value": "Order Inquiry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55da80a-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767431, "uuid": "bc47bd08-7f96-4b33-bafd-dd70474eb54a", "comment": "Malware payload (Nitro)", "value": "9098311a0769abc9228747193c020e94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767431, "uuid": "11f2c4f5-a738-4c44-a92d-4dcf35bf9301", "comment": "Malware payload (Nitro)", "value": "1bb76ebb9babf91da73cc626184bd08aa4926ca2b5d9e6f10024e045bb5dbb9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767431, "uuid": "a9289973-71d2-4424-a054-7bc73cbd8883", "comment": "Malware payload (Nitro)", "value": "4b733c6389f552c15faf93de6a9e0217b6966759", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767431, "uuid": "9615ee93-b39c-44c9-986e-ffb653ec0c9c", "comment": "Malware payload (Nitro)", "value": "be19ce76ad4b9032e91d192e5dc8e19182de9725d1428ae7f3c238bf412a9c00f16d8abea4c1faa267a56d0ff15d1f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767431, "uuid": "2ca2ed86-4747-4c99-b3f7-65a76c728b8a", "value": "T1A153542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767431, "uuid": "043aa577-cc6f-4e07-a0ef-20800d82395d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767431, "uuid": "50cbd60d-acab-42c4-941d-bc26ccf37e59", "value": "768:IKsMqCXfVcWp3M9ZkiANIUfWYLDwUzc80gmq3oP/oD9:IKse1M9ZkiAPjr/0O8/o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767431, "uuid": "202bd0ee-8542-4292-92e8-0a1c35ef4407", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767431, "uuid": "622bc301-a8d0-420f-a067-ab6e7d1606e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767431, "uuid": "3a104d61-23ff-4d17-a334-1012f2da1d51", "value": "9098311a0769abc9228747193c020e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c326b613-fb32-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628748100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748100, "uuid": "9939c855-a627-4006-aa45-01702d496a54", "comment": "Malware payload (RedLineStealer)", "value": "cdbe15a8c1176fd337db098b8ceb187b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748100, "uuid": "f29a037c-a636-47d4-af10-e7d1e73e0431", "comment": "Malware payload (RedLineStealer)", "value": "1d1dc9ca8273fd350ede4f8d783ce160ec7672e0e6354497162f811683a4a298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748100, "uuid": "37c48425-d4a7-40c4-9ec1-cebcf6b017f9", "comment": "Malware payload (RedLineStealer)", "value": "dbea5796417919da139a23ecf901c7408b45b5f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748100, "uuid": "75fb1073-1fa2-4f36-b250-a44f264b932f", "comment": "Malware payload (RedLineStealer)", "value": "7e0580e9dc8a0f5a9fdc3c9833c06aec9f049a8a0df9c341c72b37ff4270d4ace165bb879480a013130087563a50f111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748100, "uuid": "3c48e58d-0159-4e90-9a48-4cb88cb5626b", "value": "T1E0D36AE1D60724CAE87CA239E09AA12F27D1D97EE0A9D6EF7B1743C2B55C4122CF51C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748100, "uuid": "564025af-7828-4046-983a-fa58d2fe713d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748100, "uuid": "ce34fd09-9663-4c47-83ff-e0de502f2d9d", "value": "1536:1YULhMGlEtFSwRxApOhm2QPTUuE6CMueRbjvZsBXiu4T1biozTy+xFkdbe/uU/uJ:+ULhMGlO08ApOhmcibdGEVFk2BfMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748100, "uuid": "c883ff4d-7040-4591-8a7e-15932d1b03c1", "value": 137144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748100, "uuid": "962c3fb3-c550-4825-a930-c03a7353ddd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748100, "uuid": "7532650a-4e2c-413b-8761-f039bcbb0e52", "value": "CDBE15A8C1176FD337DB098B8CEB187B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d474286-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628750506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750506, "uuid": "43d496d8-aa4e-4b96-a1e2-e4b41aa095bd", "comment": "Malware payload (Smoke Loader)", "value": "c2dca8c1ee828b456168f4e3d1b693e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750506, "uuid": "e87cbe01-b9f8-41f4-bfe6-52c9b1616108", "comment": "Malware payload (Smoke Loader)", "value": "1d6c4c1009a17e69ab04390ea26068125ce2a572a0d133e3145b225184de7ac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750506, "uuid": "949e0932-7ef1-404c-96c6-c26adbcba30e", "comment": "Malware payload (Smoke Loader)", "value": "e85b5350026fe01f4ada9eceae8c8e0c3a6ea29d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750506, "uuid": "c1a7f1d6-8437-4bbe-8639-43e6a93f52c1", "comment": "Malware payload (Smoke Loader)", "value": "f6425f5616050e0fd7f8e9eedca192d7030a4864a3316b207d4f3b97069661874668bee898811b57f57a57bcfe200d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750506, "uuid": "f064669b-0c01-4c02-93d4-62444179b43a", "value": "T11F24CF617DBCD832C481053154A6CBE4266FEC717A24044BB798BB6FEE703E1A3B6749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750506, "uuid": "2e4fad79-ceed-4b81-aef9-df7130161c84", "value": "5ba12e6852ba82499f5822056a147515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750506, "uuid": "ef3f3654-4db6-4e18-a0eb-b2052bdc3bed", "value": "3072:SwAEjyMmHV+PeDbP5JgStEyScsYh6gSVywo3c+:HoUPxSk7knGyHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750506, "uuid": "bf4bf122-c735-4472-a2e7-e224ea24a192", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750506, "uuid": "c742c8f4-271a-4ad1-a020-8b29a8f8ae5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750506, "uuid": "1d3755e9-f4cb-49ea-9f53-65f10b4c4d1c", "value": "c2dca8c1ee828b456168f4e3d1b693e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94115977-fb5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628765630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765630, "uuid": "481ded48-940e-44b2-8272-fe1b4d424c6a", "comment": "Malware payload (AgentTesla)", "value": "89d937d96c85ac84865afbf4989ae2ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765630, "uuid": "0e0c65d3-b825-4e36-b588-2a1c36b0dbe8", "comment": "Malware payload (AgentTesla)", "value": "1dc6e220ff2e4478bffe3973b3da34ad2859340bd964d9f607939f37cf677757", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765630, "uuid": "db1528da-2884-4a83-9419-67081e106a58", "comment": "Malware payload (AgentTesla)", "value": "58ccfb019afe8f5b6070651049990d9c76cf3c99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765630, "uuid": "f0e51cd1-b10e-42de-9326-88cbf19382cb", "comment": "Malware payload (AgentTesla)", "value": "2938c8b1139f9fd619c113624dbdf5683d13e1a1fb98a6174b1e5a3151e01a10e62b87df2c42f32675aa045e257b9a77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765630, "uuid": "eb4b48db-e5dc-4d82-b87a-f460cc126bc8", "value": "T125551202730467BFCE58423651524541C6F86CA286E7FB7E3E5ABD96CBF276B03841E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765630, "uuid": "c7156073-4da4-4e29-b56f-2c39d9e28e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765630, "uuid": "5b7bfc8f-e12d-44d0-94ed-b4eba1bdc64e", "value": "24576:1dowsvNF43j0gQri/2Cgth32bm8ZZS5R0yxquw5wX:1doxFOB/2htp2a83BTuIwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628765630, "uuid": "48f8b851-1941-4237-aa7b-0eb1710992e3", "value": 1292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628765630, "uuid": "ea3d8f68-7319-487e-bd9c-1174d45d3456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765630, "uuid": "0b704195-20b2-46a4-93ef-f4a64033e70a", "value": "Transferencia_10744399.PDF_________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80361c0e-fb1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737680, "uuid": "9a2b1428-2405-43a5-b13f-168c11737827", "comment": "Malware payload (Mirai)", "value": "4e2a955451f000864f1b67d2d95f5467", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737680, "uuid": "77d15b9c-e70a-4df7-b291-1c77faafdd3a", "comment": "Malware payload (Mirai)", "value": "1f2d5b8fbbf9813865ab7faec9f01aff2cf572ec2a996daa720f83a25ae48146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737680, "uuid": "cb02cae8-39d1-44c6-a185-9694bce49178", "comment": "Malware payload (Mirai)", "value": "f1a2f99cae9f7a27dbe5ac9e02ee5fba390f6f6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737680, "uuid": "2de6d56b-942e-4173-940f-dee22e121be0", "comment": "Malware payload (Mirai)", "value": "973e592139aaf8cad417578aca559ab07cda2c6da68050086c79c5274c47af43c0a24bd358a9a3f4d6338771fc15c526", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737680, "uuid": "3a2f644c-2680-416d-b179-1fd02741388e", "value": "T1CEE3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737680, "uuid": "71e746d8-55e3-4ae1-bc21-57a2d9c1503f", "value": "3072:OaRBoUm6Oq+loz95hdyrzhsURxuZq+1uPNd5R:OaRBoxq++z95hdyeURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737680, "uuid": "1eed4cfd-73d9-412a-9df8-aafa4669bba9", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737680, "uuid": "32fe99ff-2772-4cd2-95e1-6d65e36ada1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737680, "uuid": "448c365d-9c9f-472f-94c0-edaf75f0725f", "value": "4e2a955451f000864f1b67d2d95f5467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c2e283-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628750190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750190, "uuid": "14dde7e9-20e0-4113-a6a1-537dea00cd00", "comment": "Malware payload (DanaBot)", "value": "d9f8f2a93e3e4a08e12a95410d2823ac", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750190, "uuid": "69acec8e-65c3-4738-b881-9a39ffc942c4", "comment": "Malware payload (DanaBot)", "value": "1f492469176d1d0bbf71de0503ac4788f7489b20e2f53f179c2826a0998038dc", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750190, "uuid": "ced01d66-2ec7-4901-8c05-144e33ae14bb", "comment": "Malware payload (DanaBot)", "value": "3224a3ac0afacaed0e1bdf961ce265def1c38927", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750190, "uuid": "30746c1f-9117-4ed6-9c01-59aac3b50273", "comment": "Malware payload (DanaBot)", "value": "0c4a83d4012d9c721d583c11066e93d7f282ff84596328b7d9830ab062db76dad50e0ed8fa34433f37e38c8b6da1c0a9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750190, "uuid": "8a3facc6-4534-4500-b3f2-840840db7096", "value": "T11D4502307A90C430E8E712F845FA937CAA3D7AA1973550CF92E526EE16346E4ED31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750190, "uuid": "58484ac9-d427-4216-89b9-0867a38f09eb", "value": "0b2673717edc4e64b07cfaab3e6cb412", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750190, "uuid": "f66addf9-ffe8-4181-9d39-cb9f1353bdd6", "value": "24576:8CxesLTH1zZ5SBuKo8lLKgiK5E+WDG6+cTyyF8sFv:bL5V4toTT+WDG6+cmyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750190, "uuid": "69d63e82-d690-46cf-8d8b-09701dc8c92e", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750190, "uuid": "ca01403c-1786-41b3-a143-f3652a9e62ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750190, "uuid": "08df2b3d-ee93-4a68-b97f-b2cb7b5dc694", "value": "d9f8f2a93e3e4a08e12a95410d2823ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a730cc8-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767198, "uuid": "0384dd53-9470-43cb-bb03-119ce2771dc2", "comment": "Malware payload (Nitro)", "value": "86fd62f1cbbb0de698b84daaeb1c5863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767198, "uuid": "c4713a1b-f5cf-41c0-b368-95828f06163e", "comment": "Malware payload (Nitro)", "value": "1f93a03efe3f2b44397bb89d0329d37370fdbea408de54e43f4144635dd2c4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767198, "uuid": "b563a53b-4d06-4e37-8b57-4a1be341ddb5", "comment": "Malware payload (Nitro)", "value": "1a5e0a66fceda49dbb45083276fa15dd85a2c5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767198, "uuid": "f8d8317d-f6ae-4267-a051-3401211a3dbe", "comment": "Malware payload (Nitro)", "value": "821dc18dc1abd63068e95819924f11a51c58e71dba2324433d425a35832f872a8b06161833cb3db0793c74f1d819a02e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767198, "uuid": "081cc2ef-f116-4681-a525-49c29905a436", "value": "T16453542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767198, "uuid": "a406b20d-ee61-402b-9fb5-ed8ce727b6ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767198, "uuid": "4f172b4f-8282-4230-8d10-c54922bd629e", "value": "768:RKsMqCXfVcWP3M9Zk4ANIUgTLLDwUzc80gmq3oP/oDe:RKsefM9Zk4AP4r/0O8/oK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767198, "uuid": "4d671052-bd98-469f-b8b4-fffeb4d50811", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767198, "uuid": "c8a224d6-0977-4a44-8e15-8c856786f755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767198, "uuid": "c7897107-856f-400e-a012-bfb5f999756b", "value": "86fd62f1cbbb0de698b84daaeb1c5863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fead1801-fb0a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628731020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628731020, "uuid": "105df259-8dfb-4e67-8089-3317240b5ed5", "comment": "Malware payload (Formbook)", "value": "246284cbcfe1cb851bada6dd84b70e80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628731020, "uuid": "32eb0b53-ec9b-4dd4-a26b-c36c89277ebe", "comment": "Malware payload (Formbook)", "value": "20b597d93eb4d2b2bc15ff25aebb0d171918f99047c31f6eb728833967c8c37f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628731020, "uuid": "2735b01d-fe6e-46ef-b755-8b717cf5f904", "comment": "Malware payload (Formbook)", "value": "1cba6dcea6d3ddf86438c3107d38620a52ca1417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628731020, "uuid": "35cc517a-1229-4949-943a-0bcefe95ab05", "comment": "Malware payload (Formbook)", "value": "4902b39183adf5fe39abd7b473dd2f8cb7d584a668c8b5d211979b0994528b5f0eec729d39cf51781d13d0f6242fdd85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628731020, "uuid": "f0e2b609-5f5b-4048-bb42-c50996b25044", "value": "T17E441298C7E1D412E820F9FAA02D4FF88B7BED782065D85A9D90BC1C693D64DD4BD342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628731020, "uuid": "2c02d9f0-f7e6-44a6-80af-24340e403018", "value": "48cf05311e4a3e8be7b754cbebbc2209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628731020, "uuid": "6a5094a8-8fc6-430a-a320-6b5b4e522550", "value": "6144:cHELyizo4hTiZM9bCQUO0NAMlfmptut/AKkkBBiQd/PE:c7is4UZ3NxlSiYKPMQJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628731020, "uuid": "b56e0d3e-1360-4cc8-ac15-a39bf36cdd9c", "value": 260218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628731020, "uuid": "9604502e-6a18-413f-92be-2d7f32a3edfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628731020, "uuid": "a7379e92-e2d5-4311-8db9-96b19645eb72", "value": "Roominglist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688a680e-fb34-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628748807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748807, "uuid": "b2d4e460-f68c-4576-b26b-b06a8f98fc69", "comment": "Malware payload", "value": "2b25628a738eab6eb7b4b439d46f5b2e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748807, "uuid": "5a529409-dcdb-4695-8d4b-30cae6d4e276", "comment": "Malware payload", "value": "21c1363f15e33ff8f536da8e5fdd0a08b5281637f17daa7926d9ae35628b0728", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748807, "uuid": "65f3b8bb-798a-48f0-b19b-7996f03f74c8", "comment": "Malware payload", "value": "6e511b7ff6c03b4fdf5edd93e91595b422bddadd", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748807, "uuid": "678bd64b-8922-470c-9f68-b755b902669d", "comment": "Malware payload", "value": "189b6c6ae0cdf52897c583622be76c2ff527cb01643c172b0577a58d0c0e26849bbf8072ecf1a67e4fe1f995afadf010", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748807, "uuid": "035f6cc9-9f22-470b-b859-837b642d1c70", "value": "T1B2016BEAC4143C3B69415210806CE5D19DB413EAC4F9C87DEE6D0A4BA69B24C07FC372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748807, "uuid": "4a3549f2-7f38-46d2-9271-d01be5190640", "value": "24:2dtz6fl4xflKJZ91/6rZIa+00xctkxSoYD4IkRj4CPy/mb:csN4xNKJZ9GZz+FOtk47khF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748807, "uuid": "b60f44b8-a25b-4fd4-ba4b-ffde214cd2f5", "value": 820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748807, "uuid": "be347be3-d870-432a-b6f5-5ccdf3a9b53f", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748807, "uuid": "3ca250df-fe43-47ff-b302-31c981865c60", "value": "app.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910efa03-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766914, "uuid": "9d8d2339-bbbb-4119-8c29-6c7716179d18", "comment": "Malware payload (Nitro)", "value": "4ffba1d0c0afc2bc3db4d5e5b7f72b61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766914, "uuid": "60641768-5e07-4b7c-bef1-2bac45959482", "comment": "Malware payload (Nitro)", "value": "21e37136992900f9a403c3e7eeddec4f66ef053fad7c4750a95528697272c043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766914, "uuid": "75030f4e-6aad-4aa7-8cd0-4dfec666bb76", "comment": "Malware payload (Nitro)", "value": "664b9906038285a93edb985102d841667df97474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766914, "uuid": "f17a3d91-3b06-4388-8887-7736c19e0218", "comment": "Malware payload (Nitro)", "value": "72cb407225c7560b4c576b81305056b452a783500b1f9133d47712fc3cbd9cffbea3fd33997b7c7f71bb0af18ef20593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766914, "uuid": "bf76fc11-5f4b-4e53-9a06-be5a52505d30", "value": "T1ED5364286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766914, "uuid": "e5e1e6e0-156d-49c2-b9b2-1a63b39c36b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766914, "uuid": "5912acd0-0682-4c72-8f82-5a0628400378", "value": "768:pOucKn7n1JzDNANIUmMvvLDwUzc80gmq3oP/oDu:pO2zDNAPvr/0O8/oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766914, "uuid": "c283c2fa-7c0f-4892-935e-c98403ec71ea", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766914, "uuid": "026405fe-fd79-435a-85e5-3196d39c83c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766914, "uuid": "d290dab2-7182-47d3-bde1-e9202d3208e3", "value": "4ffba1d0c0afc2bc3db4d5e5b7f72b61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea9546c-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1628755367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755367, "uuid": "954af19f-3210-429b-a8aa-0723de45cb2b", "comment": "Malware payload (Pony)", "value": "9a813a694390804d6d8cc05ac1efe79f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755367, "uuid": "19fecf2f-7e45-4601-9f05-a70d11d8ac90", "comment": "Malware payload (Pony)", "value": "221f9234191861597cddd0b7ed46d92f05ec2adf3b077abd29e5c60ead2f9cce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755367, "uuid": "29d28304-2ebb-4fa2-b075-dfa850a0c291", "comment": "Malware payload (Pony)", "value": "cc7071c37e771e9e83788b3436a2109402e72a24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755367, "uuid": "0878e415-2a2b-4f3d-837d-545cb9e0c0d9", "comment": "Malware payload (Pony)", "value": "6f012d5e8cb392270fabe82bc0a7f75ce0ccd47b84dd1469486bc879fe4931c25e7773e4f5eaefa913e6c2760cf3a471", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755367, "uuid": "7c562339-90b6-4cce-842c-0d44f02a1a37", "value": "T19965B53C29B9266FC076C675CBE59827F4009CAF3212AD55A4C73366473AA5379C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755367, "uuid": "cbc3dea0-af62-4c6f-9dd0-77da5112807a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755367, "uuid": "95c8a482-6786-4df0-a667-78a6a6e04dea", "value": "12288:j62HNa81TJieSsFbDIqpM+WsIqEtNnOOAR4q1uWmbFT2fXaYRvXxelLb0g8njG9m:ZHcw0fsF49ls3NOAsWmbFT2fXMvOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755367, "uuid": "45b301f8-e0e2-4360-9920-56b349a86643", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755367, "uuid": "74ce13d8-ec17-42b9-a1e3-5a854c80370a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755367, "uuid": "40401f79-a2b4-43e2-aa2f-73b6cfec89be", "value": "9a813a694390804d6d8cc05ac1efe79f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710267e6-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628750539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750539, "uuid": "6ffc6b78-3f9f-4859-8651-5da6d5dabd80", "comment": "Malware payload (TrickBot)", "value": "b18799fa7e17a450a7d722ef5629db26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750539, "uuid": "a2c590d8-2633-46c8-b44b-2c52894c953f", "comment": "Malware payload (TrickBot)", "value": "226321291fa1d596e9a0dc89992fc3e36eb070d06c02df249593a3193d216ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750539, "uuid": "b44fd934-cf20-4dfd-8cad-d66af57b81b3", "comment": "Malware payload (TrickBot)", "value": "3d609609fc84475010b3dffb94a4114efb2ee8a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750539, "uuid": "0032a069-763f-4cce-ad22-27790075dabb", "comment": "Malware payload (TrickBot)", "value": "c2f95281e0831eaa12b104e08be8cf31a2ab9cf7afcb618fddad8435d63a65ea30f96b4348e3eb8cf1a9f9cca313c552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750539, "uuid": "b946992f-788b-45f2-9a05-173f5ea143ce", "value": "T1FE15CF5635F08037C6B25A714E2A2B2DBAFAFD684B7394C363884B5C59709D11F3633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750539, "uuid": "cd552d1f-3fc9-4b30-b3df-391566edf369", "value": "a36b8c98f8710737441ff391a1167b41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750539, "uuid": "64771631-de0f-4c2e-bf62-612f3f8bf7e0", "value": "12288:ZUKFfy62YznW7A+YTr+PoIIxOexW33pKAvsrvl5a0R5w5f:1y62YTW7A+PIDO3dviTa0ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750539, "uuid": "c56912c5-2079-41f2-b255-f9286dc578a7", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750539, "uuid": "4eef8ca2-fc2c-4c90-9c01-02f099921454", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750539, "uuid": "9b176fe8-41bc-4c00-8c0d-7474e78528ad", "value": "b18799fa7e17a450a7d722ef5629db26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21aacfb-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767426, "uuid": "2a3e76a0-1463-4edf-8339-c31b14008434", "comment": "Malware payload (Nitro)", "value": "5373639f26e038d14f1d31e15ae2df10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767426, "uuid": "29e4df1b-d40a-4b77-9802-ab82c55c504e", "comment": "Malware payload (Nitro)", "value": "22676a7fa8d469132dbec60a0baf79848013dec8bc0d4bf68faf5d4af754dcfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767426, "uuid": "0e21fa49-ce2d-49de-9e8e-842072cdc8b0", "comment": "Malware payload (Nitro)", "value": "40d4d947fa1d6fef7e5d8efb08b45647345314e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767426, "uuid": "dd9412f1-9a68-47a6-a3ce-35a19dde12a5", "comment": "Malware payload (Nitro)", "value": "a55e8e64619b4688a6d5220c90ac699a269964e17351dfd55cd7d15340f3db629e1fab4610196beb76227d66d38735c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767426, "uuid": "a018dca9-6719-409b-b4c0-cb90ec44178b", "value": "T13153542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767426, "uuid": "f1970ff7-3019-4c09-b3f5-f42a382ca49b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767426, "uuid": "83d3debc-3e93-4cf7-a1ec-77ae85b698f2", "value": "768:+KsMqCXfVcW8bM9ZkiANIUG0oYLDwUzc80gmq3oP/oDa:+Kse4M9ZkiAPG+r/0O8/o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767426, "uuid": "b1271e6a-ab00-4aaa-a5cc-b32ce8af21bb", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767426, "uuid": "3a70fa9e-2cb3-4cdd-ac9b-76866d471c6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767426, "uuid": "bb852a71-3872-4e81-955f-1876011ada45", "value": "5373639f26e038d14f1d31e15ae2df10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045e5511-fb34-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628748639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748639, "uuid": "b1521ae4-47cb-401f-b1ad-0cd4b4d43062", "comment": "Malware payload (RaccoonStealer)", "value": "56e898535905db881f877ee10efc4807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748639, "uuid": "df8ea83c-eb46-4ea5-809e-426789f0c793", "comment": "Malware payload (RaccoonStealer)", "value": "229e3a66dc45f2a203e26ff364669b43e28ab5fb9aa4c5d560fb30751d8d67f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748639, "uuid": "396fce1e-afb4-4a38-841c-7fb951e7b2b0", "comment": "Malware payload (RaccoonStealer)", "value": "5cd489732e7b8f4ae32eef64fb46e17ce5600b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748639, "uuid": "494932a8-d190-4c7d-8006-9a8f980de5e1", "comment": "Malware payload (RaccoonStealer)", "value": "5993261da1523f7222502caac9d5de4b2fbe1d5fbdf1919bc84a0b18b965f5902485487b47c377e94b39722720efddd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748639, "uuid": "1aa23a9d-2bac-4251-8611-ee34006a0c22", "value": "T1E1B401117DB8D972E49989744822CBF4293FBE51B95914477BA83B6FFE303D1032A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748639, "uuid": "16cabfea-949c-4537-9493-77e630c4fabd", "value": "a4e471c7fd9fdda76efc364ccf330c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748639, "uuid": "ac77382b-6ca0-41fa-9c18-9805bdb6acee", "value": "12288:lZRci2MekWbmZcAIMOAtPQZl7aBjOQZ5i7I:lbxWbSFOgQLaJOB7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748639, "uuid": "06327eda-acbd-4265-8969-2d4a4dbe4231", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748639, "uuid": "473b246c-42f3-4a63-b4e6-7a264fd8e0d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748639, "uuid": "e5993c86-a34d-466e-a849-84d5a5e70393", "value": "56e898535905db881f877ee10efc4807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd8994a-fb13-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628734560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628734560, "uuid": "dbef5ce2-0807-4146-8743-dd67ab1fa92d", "comment": "Malware payload (RaccoonStealer)", "value": "506962077b6d4f41f6879641bc8c8695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628734560, "uuid": "6931fb6a-7cb2-43c3-88c1-66f7a61d8168", "comment": "Malware payload (RaccoonStealer)", "value": "22c622082b1db75bb23f602ff64c49158d9740e63a0441abe52a47e2f961b57b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628734560, "uuid": "3fb556b1-26fd-4581-b1e2-5e48303bc2cc", "comment": "Malware payload (RaccoonStealer)", "value": "f2071382ba9d6eef51a56ca754247f669602440c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628734560, "uuid": "4cb111b8-976d-4b44-83c6-1094f633d9ff", "comment": "Malware payload (RaccoonStealer)", "value": "d942c0138856461bf11cbad4edd5c37652083419ea8bf0e9181c6265bad9d60d3207f3f5487da75ee3a44955122ade12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628734560, "uuid": "e86c0089-a021-4355-a6b0-5c98a7a9a1ed", "value": "T143649E30AB90C431E4B612FC45BA93BCB92C7EB1972450CFA2D42AFA56345E5EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628734560, "uuid": "134ce5c8-e96b-49cb-b3a2-32ef959267cd", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628734560, "uuid": "a91504b5-1c62-4792-a6de-d383bad5e637", "value": "6144:3fVOSHxjjmIrQdBDMeqQ+PWLXLtpQ5rZ2AqROCuSsfr:ISHpX0ddV+PWLXL7wZ6MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628734560, "uuid": "401ef1da-6d86-4615-9efe-6627c4fd5a70", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628734560, "uuid": "4c304859-e52c-4566-bffe-9f9b397816cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628734560, "uuid": "d9ed68d6-c10d-4093-8003-5b9441cb91cc", "value": "506962077b6d4f41f6879641bc8c8695.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497cb896-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767653, "uuid": "7df41af5-4e95-4af1-851d-444cc18d384c", "comment": "Malware payload (Nitro)", "value": "cfbcad3826a5902dcac02aff1ce8f964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767653, "uuid": "6bcb63ea-4352-4902-ac8e-74eba1f6cb76", "comment": "Malware payload (Nitro)", "value": "22f76fbedccd2b6d37fef02568b5105c9317c95d1e9e57f892c572432ee37433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767653, "uuid": "62cf6c1c-ecf0-4cc7-a0bb-b48dce7b78b4", "comment": "Malware payload (Nitro)", "value": "fe53de96c1dbf70f41ea956404fda39b506ab1ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767653, "uuid": "223143d7-332d-4339-86ae-c7f340d6a104", "comment": "Malware payload (Nitro)", "value": "a9c862be3c22689ed937e9c4edbfc9370a44373dd3f3492be225f9fcca1a772fe38d43530f6f94135df14868fd43939b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767653, "uuid": "ef5b8a8a-9c0d-43f3-ada7-a5d3cef02619", "value": "T1BF53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767653, "uuid": "b4ea2c86-2081-42db-a3d3-940027bf3724", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767653, "uuid": "040e3023-258d-4082-9ebb-1c324ff670a2", "value": "768:tKsMqCXfVcWrqM9ZkiANIUT1YLDwUzc80gmq3oP/oDW:tKse2M9ZkiAPWr/0O8/oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767653, "uuid": "9dc1647a-995b-4f4a-903d-96822e40e29e", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767653, "uuid": "fd5fda2e-ec0e-47fd-852c-12f5b3451d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767653, "uuid": "ffc895cc-0518-43d1-9213-41a60b03c074", "value": "cfbcad3826a5902dcac02aff1ce8f964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5e78e8-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628767226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767226, "uuid": "a99edc01-abaf-42dc-b022-5f5db2cf6ac1", "comment": "Malware payload (CoinMiner)", "value": "2dd7cacaab277d37dace276fc3c98f32", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767226, "uuid": "97fc084c-cfb4-43fc-8755-17b332dac3a2", "comment": "Malware payload (CoinMiner)", "value": "2340f7976585cd113520b33eb51c6b57e37c6bad2fba29a48b8c7e8e784a2491", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767226, "uuid": "f7a60744-8d77-4deb-b6e1-9909536929b9", "comment": "Malware payload (CoinMiner)", "value": "7227f97f9539a7620ef4ff6687394bce9220d972", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767226, "uuid": "69229e0d-9748-40dc-8c2e-cebfbb98ed56", "comment": "Malware payload (CoinMiner)", "value": "deb46339b53be841c143939b5febf04c8b7e590a1d840cbdd1ca5404477594908399d648afd46f6c497b680882e666fd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767226, "uuid": "dcef8092-c833-4974-a0ef-f41fd484827b", "value": "T13BF3AE13776680F2F68E02B96C526746C3BBE4320FA287C3B79253295E325D1FD32656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767226, "uuid": "14ca0c5e-cd1a-4fd5-b759-8e3ee2ba57c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767226, "uuid": "bb8093bc-ae11-47a7-88aa-e2413a3b59be", "value": "3072:mSKJbzx0eTzNRvcF9mOQEUzJw4xE+vn84Tt4dVmfyu5ytLNoH:pWztTz709mVEUzvydVk5ytLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767226, "uuid": "49b14949-42e7-425d-bc1a-120a058989a1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767226, "uuid": "254a0a07-d5ee-4e7a-ae40-91edb3f3ac47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767226, "uuid": "c67c5c92-1cf3-421a-af06-f0f0761f5fcb", "value": "CSGhost-v4.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6b3fce-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766960, "uuid": "28fa84ec-82db-4828-be1f-05b92345430f", "comment": "Malware payload (Nitro)", "value": "6bb07e39b4d4e9bfbb9e54e258df3a69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766960, "uuid": "eea646a4-bd4a-4e16-85f9-9c8f2f09c6bc", "comment": "Malware payload (Nitro)", "value": "243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766960, "uuid": "8aeaccdb-569d-4174-8bdf-6d914ca4a007", "comment": "Malware payload (Nitro)", "value": "05b94256cf8d175385af8c5b15f122fdb2e5d374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766960, "uuid": "854c2ce0-9647-4e1d-9063-27bfe1a4166d", "comment": "Malware payload (Nitro)", "value": "5c222a3a9d64c19f4de7831acaf6d5962c04feac57cabe122b7be3100ff67cac2e1e4ecbd8805e9a5b163b054cff8ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766960, "uuid": "1c39cf07-91c8-4b3a-9166-729cabb8de58", "value": "T15C53542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766960, "uuid": "56cfc766-34c8-466c-b2ed-3065e91b25be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766960, "uuid": "dd94b9c7-e471-45d5-a84a-2e0a94b6aecf", "value": "768:bKsMqCXfVcWO/M9ZkiANIUK0YLDwUzc80gmq3oP/oDQ:bKseiM9ZkiAPAr/0O8/os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766960, "uuid": "1122c2f4-1aa2-4717-ab0c-e0f811c7fba8", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766960, "uuid": "ad46b984-b7a5-4e1a-859a-fcbf8a063731", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766960, "uuid": "0ac5c0e6-0330-4eee-8b1d-598e05b6314e", "value": "6bb07e39b4d4e9bfbb9e54e258df3a69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119371d2-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628776149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776149, "uuid": "ff9df7ef-1ba5-4b7d-bef9-fd6401840676", "comment": "Malware payload (RedLineStealer)", "value": "e597a534eb56f4ceb19c06d599f75a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776149, "uuid": "9bd79f48-69f1-4377-af8e-1700bb7c7b69", "comment": "Malware payload (RedLineStealer)", "value": "24bb15d093025a935e0de62e850056aea484990c713517cd53de6696b5e9db52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776149, "uuid": "137a7707-c9c5-46e9-8564-264b0d160ab7", "comment": "Malware payload (RedLineStealer)", "value": "91eedca2f5cbcf2331c4dcc2f10395f9653df794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776149, "uuid": "190c5353-4d12-4b19-be73-172c09b666a9", "comment": "Malware payload (RedLineStealer)", "value": "a93c09730b43eeb2cd7bdd9c0d5cc3e9a45009f1c46e5fe9bc0c1ef30d0a786dea62285dee6089e6ffbad7e7122f6bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776149, "uuid": "f51a0d30-abff-4446-80fa-9ae00af66065", "value": "T19784AF30FB90C035F5B712F849B593B8A52D7EA0573880CBA2D42AEA17346E5ED31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776149, "uuid": "85587eaf-b607-48d4-91f2-be8678c4f84e", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776149, "uuid": "1a5ce2b6-5e96-4791-956a-339b347dd537", "value": "6144:4SfwVx9vZVqakzsoVvKvJijIk2cZ2BUnd7TuT9Ey7SybF52NaQ9y5w:TwV3XqaOr8vJijccaUNiTeGFAAQAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776149, "uuid": "731bcfc8-4c4b-4a97-872b-df5a06b2608e", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776149, "uuid": "678d794a-3266-4783-a60e-eceb054408f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776149, "uuid": "35d71625-8fa4-4511-84d6-d4084d2f0738", "value": "e597a534eb56f4ceb19c06d599f75a03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cd6a1f-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628767190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767190, "uuid": "24900c13-2746-4927-8e41-e81f69514981", "comment": "Malware payload (RedLineStealer)", "value": "179dbbdb6e22f978115168d87a70ab33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767190, "uuid": "bdc31969-c305-4d54-b1bb-0b22cb7fc467", "comment": "Malware payload (RedLineStealer)", "value": "258445b5c086f67d1157c2998968bad83a64ca3bab88bfd9d73654819bb46463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767190, "uuid": "ba131e0d-168d-4ed1-8aff-d59b46a30c95", "comment": "Malware payload (RedLineStealer)", "value": "324a73e17fdcada034d3ad841286f9d6b5873fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767190, "uuid": "608e1f12-bc30-465e-81fc-5c3b08330dde", "comment": "Malware payload (RedLineStealer)", "value": "013c1d2332f88083d236649857df6c4def97e5419a182d75fad438f9de70c5725f5d96216796882038e640d021aefc2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767190, "uuid": "3bd95dd4-9cdd-4b14-b71e-f7d6f3a3e874", "value": "T192742390BFA19E31E8CA0DB2B0AB7C6916713A183E83D38E776C50642FA3753715C54D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767190, "uuid": "a295f3ca-50f4-4b6c-a851-e7294428cd82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767190, "uuid": "0cc81aa9-f11d-489e-a70d-c9d06ca18326", "value": "6144:zo9QlVmhcIS/rwO+l7qYspB2NnYXmJ8tuy2a9W17fyF45pDBKoydJ:zdxrwHRqxQNYXO8tt2aw1DyWPDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767190, "uuid": "6cd88c1c-4b39-4abf-94c2-1151c6d91023", "value": 365224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767190, "uuid": "43eeb040-580a-4a4b-94df-793b1faabde4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767190, "uuid": "7c3085df-5e6f-43fe-8838-3ee84329475b", "value": "Vape Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fd4509-fb27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628743142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743142, "uuid": "da8625a1-d02a-4027-a539-489dba0a8e30", "comment": "Malware payload (Gafgyt)", "value": "9ac67d92680122cf9c7ca8bce9d7ef24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743142, "uuid": "192a65a7-19fb-4351-8ad4-357b8b94d022", "comment": "Malware payload (Gafgyt)", "value": "2596615e2fa2a5bf95667c3058446c1a48378d40c5f250ac00d6ce69cd887d62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743142, "uuid": "7886ebda-1957-4d96-979b-920ea07b332b", "comment": "Malware payload (Gafgyt)", "value": "68928c1d00e19e560d0f5ba90989897e85c3c512", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743142, "uuid": "57062325-4812-4cc9-b55e-905b442cbf8f", "comment": "Malware payload (Gafgyt)", "value": "c3e0c3c8cf6d6cc4267c5dd5f9ab106b6ff01781f191fcd4586eb1c13d06dc27db68e276111ea1954219e4181e3cffaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743142, "uuid": "9672cee3-032c-4a86-a77e-d540d56f83ff", "value": "T1315329337B174E23C0CA55B145E30332B7B1D64A2CBA879779916EA83F12BC439563E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743142, "uuid": "8efde700-9b7f-4408-8eea-43a9883e63f5", "value": "768:gNAwZy76m74luIec3h64hJdMWGozfsO+YM5V3FQoY1tOQxPIZzuLV4KbSiUI:ehsGJ1SYM5hUtnxPizui7PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743142, "uuid": "a668c122-4cd4-4fd3-9241-eb6f63546bdf", "value": 63861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743142, "uuid": "a100aa85-f97e-4b78-abce-bef966154393", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743142, "uuid": "3babf965-b840-40fe-b2ff-0907cf4d8e27", "value": "9ac67d92680122cf9c7ca8bce9d7ef24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e586cc06-fb6d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628773498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773498, "uuid": "24990b0c-3abb-4a5a-a4e3-21fa05488b53", "comment": "Malware payload (Formbook)", "value": "5de16e644095099e744f588690e7e400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773498, "uuid": "d4343005-1715-487e-8092-de3bd6249987", "comment": "Malware payload (Formbook)", "value": "26fb8675c58beebfed1a2c246fa5fd658ed0286305dc64683fe4d34b41cc5a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773498, "uuid": "e10dfcb1-cbff-4e34-8850-9ef1cfff6dc2", "comment": "Malware payload (Formbook)", "value": "0e3dc321554ae6081ee7f4437353457d7360d121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773498, "uuid": "4eab93a7-fc00-4a30-9e10-385ec7f66fe5", "comment": "Malware payload (Formbook)", "value": "2c697b86b7ef1fb3cebd92844dbb3d85ef079306019e092fb45c5df27d6cc59beea91aaba7fc2746c763f9f720777b8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773498, "uuid": "e28e2a17-f21c-4209-9264-0fe9f7c0bec4", "value": "T1B234125C536CF73AD721C779350B62FAA86B02BD2B9F5433A3C502662A5B0D29C76F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773498, "uuid": "e9f0ceb9-a78f-4341-8a74-f44f1c0414b0", "value": "dc195339b27b4fd5a57110edcd4091c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773498, "uuid": "1fa70fe1-9c99-4e7c-8533-9a527c391068", "value": "6144:10khhhhhhhhhhhhhN8gBVP+MO4L952L6sCpKN2LKgP1Gkohh8h8mHxpBmPZO:GkhhhhhhhhhhhhhOgvP+MzL95X7P1Ghi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628773498, "uuid": "99c60129-0354-4227-aed8-86127bcfa28e", "value": 235096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628773498, "uuid": "3fa450d2-c710-42fb-aae7-fd4de17b6bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773498, "uuid": "7991d785-67b3-42fc-a0be-60d796763ee3", "value": "ctm_arrangement1821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ec1ce5-fb01-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628726767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726767, "uuid": "1903ece2-2df6-4a16-a10f-6807ae84e554", "comment": "Malware payload (Mirai)", "value": "7b7284dad73cbd97eb07faf95e0d2f2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726767, "uuid": "4231c261-cf80-4163-93ad-13efc02f15d8", "comment": "Malware payload (Mirai)", "value": "2872388e195f40a06f2cc197569c281942e25d35ba4c11098aaf34d191d0ec97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726767, "uuid": "99ab2ad7-bc26-49db-8282-458b429e8c5f", "comment": "Malware payload (Mirai)", "value": "24d643b40080473c3ee9f213111a34ae24db01fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726767, "uuid": "8da4e269-55f1-4b06-9a30-85e8f9972d94", "comment": "Malware payload (Mirai)", "value": "a730586e0f8b4d551e83e36afe6b69ea32f41d66cc938d9daaa4f9367977167d40583c7c5c494986d1f5eb6f73401c8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726767, "uuid": "8b70bc8d-71a8-4b6e-9fc5-59914ef2b89e", "value": "T18BE34B46FA818B13C4D5177ABAAF41493332A794A3DB730689285FB43FC676E0E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726767, "uuid": "ed9d698d-1a80-41bd-816f-a9847dd6277d", "value": "3072:8hCj1qyA1k84yzuhjncl1gXGSC2ReX51C7cf1ChcSff0M/9FU33l:iCj1qyA1k84yyhj46ReX51C7+1tSfcM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628726767, "uuid": "28b8cb42-4c1f-4808-9a1d-602964422636", "value": 148941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628726767, "uuid": "2055ef73-6866-487a-a8b2-14bc322baa47", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726767, "uuid": "f4212a15-984b-43d2-927a-e72631c29464", "value": "7b7284dad73cbd97eb07faf95e0d2f2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2056e92d-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737949, "uuid": "1e038164-b065-4a8b-81ca-9de1b9b55191", "comment": "Malware payload (Mirai)", "value": "e6aae90fbb0d6b7e287a89708d3513b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737949, "uuid": "9a279f36-2b78-4a1e-a5f5-5539dffbcead", "comment": "Malware payload (Mirai)", "value": "29626257c021c1d30a4691f1c5142113e26dd9bd2ba42293689218d8f7d87c6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737949, "uuid": "bddbda7e-0c05-4781-add6-1adb38a4e2a1", "comment": "Malware payload (Mirai)", "value": "8d611bc62d8ec7149bf64c3f9522aa1a28fb3189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737949, "uuid": "e9d5737f-b303-4e92-94ef-589ede4eba72", "comment": "Malware payload (Mirai)", "value": "e93fd21aeb1526ff7f4fa84f4dd3b863d1c9dad1a8d6db6d6e7e743d210f85e2d849e4136f0b0429140b8ae8db7f63ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737949, "uuid": "033fe2e1-4ead-4b3f-bbea-90f2662b7452", "value": "T1B3C32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737949, "uuid": "f9864d15-1538-4b12-846d-4ed7a67236e3", "value": "3072:/YNa/GLBNPoQxphakpiQ9/nYEP/UnSQf/R:6a/yloCphakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737949, "uuid": "f2117366-d9ec-49c3-b1cf-ee5bea2f6609", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737949, "uuid": "cf5179fe-91eb-4527-ab9a-fef1ab0798b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737949, "uuid": "c3da7156-3d5f-44c9-a61a-ede50701bd05", "value": "e6aae90fbb0d6b7e287a89708d3513b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555ad597-fb65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628769820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769820, "uuid": "73e2ed75-1837-4cf1-9746-995998376217", "comment": "Malware payload (NanoCore)", "value": "2cef208d03ae2f434c85229428c66724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769820, "uuid": "139eb11a-d3f9-4310-8615-d8982bd564fe", "comment": "Malware payload (NanoCore)", "value": "29c3861feead5d99c7d2e4c1a50dd6b29f8ca4d8add002ca8028d2f876abbbeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769820, "uuid": "1cc7b6b2-12e9-4966-ae7f-c8dd66433c7a", "comment": "Malware payload (NanoCore)", "value": "e3cb0614661cd3fe70bc4bd245678920e776c9f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769820, "uuid": "4e07296a-adf2-410b-bf2a-2b5f98e81019", "comment": "Malware payload (NanoCore)", "value": "e6d60b74af3d1389ce5ad9d3e0c0b1cccb2210358b2107676aa4ad5d8a8d5ef75a08f324c45ac64a2578e299603b080b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769820, "uuid": "8bc2ee2f-3000-4270-8995-038c484fe2f7", "value": "T1B005DF781508963BEA3EC036A0490356F3BC8ED6F5CDCA67F4C3A45190F222567D9B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769820, "uuid": "9c0a5bb6-f6d6-4873-bd9b-a6cb174b3e0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769820, "uuid": "4159e71f-a65b-43da-b8b4-a81c3750a7f1", "value": "12288:vB0UM7PtYaerVBsrZBcpcWPk8ZQddwtxUMOnzHekqDE0F73vYaer:vB0U+MrVm1B4tZO+tHOzHcl7Or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628769820, "uuid": "2e136687-edf7-4aea-9cc7-74024a1cefe8", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628769820, "uuid": "a0ae4bdb-0f89-4891-bfa1-493e012ddfcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769820, "uuid": "2a80b184-db2c-4bc6-bc31-4e91a7176144", "value": "AUTOTEK-DRAFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f70c4d-fb41-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1628754549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754549, "uuid": "16696e86-635e-4414-893f-9a94b770746e", "comment": "Malware payload (Alien)", "value": "eb73dee8702ed7e3582e4d6ac3f47e74", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754549, "uuid": "f191e2ca-8e80-4e66-85b1-14733125c632", "comment": "Malware payload (Alien)", "value": "29e4bdd32b7f308d1a138dcff54c30ac11aa5c178f6e19fe413c7999fdb120a9", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754549, "uuid": "b5c69317-4d3f-4190-8da1-9837793a1345", "comment": "Malware payload (Alien)", "value": "eb2ed2bed4c2a0409d7e17034b408ca676dbb254", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754549, "uuid": "59adbf8d-160b-4b93-859b-10af0a02c974", "comment": "Malware payload (Alien)", "value": "add41209eba18074fce704c3af5ef951acd55fe0945fcf7eae56314a721be6fd3f821c08d56cb4e097cdeb3d9dbe4f82", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754549, "uuid": "3a4b9bb4-294c-48ea-802f-94b5f4927ac4", "value": "T1AEE53389EA83D49DD6378B70521B2963766E552D80C2F53F167B41D838BBCF08B0BCA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754549, "uuid": "1d169bdf-f119-435d-aad0-ac3394c3a12c", "value": "49152:DfxBJaK11uGSEJJ4y6pkcyoyheHwnT+wpLhdpqPCM4Wk7g5FZGNYJ1hbSJHw:kK1A0WkNPrCKLhnFjKkNYJIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628754549, "uuid": "7f7b9ffd-7d49-44ff-8bbe-735bf22911cf", "value": 3059645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628754549, "uuid": "5003535e-64ee-46c6-a775-e2a9f3f37a49", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754549, "uuid": "c9712556-c8c3-4e5e-be9e-78b15140c8b0", "value": "Porno_Izle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2034ee05-fb49-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1628757705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757705, "uuid": "1b372d38-a27d-494e-bf91-40b86f34176f", "comment": "Malware payload (Hydra)", "value": "c37ae32cd4bcce93797535082e2080a2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757705, "uuid": "323b7a8b-919e-418e-8e95-4fbf8ff0e278", "comment": "Malware payload (Hydra)", "value": "2b305310db25d5ac714d4e5df898fa336e0bb3b86039b42ea37762f00956b3ff", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757705, "uuid": "d797bd00-d8a1-4608-9064-fa09fa6d687b", "comment": "Malware payload (Hydra)", "value": "ae84294f83e45c8a9180cb6a0e658181fdee62fc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757705, "uuid": "92872265-6126-49fd-a458-58b2a678898e", "comment": "Malware payload (Hydra)", "value": "bebd0672d0d0c5ec592bee916e07c41682bc9199038daba25ad92f154c24e9d022542f2cd2c6d67e58b8f903b6b5176b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757705, "uuid": "0cb7abaf-4751-4ab7-b056-322cc7c7e376", "value": "T16CE533529837C74DD70BDC3385C5488AE209C3AE3692791AC757DB989C62ED92B13CCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757705, "uuid": "b1299040-caa5-460b-a41d-bff9fb6083b2", "value": "49152:4MZfhiOsnVv0VdpuowM1EqMz3KDH8ZEesJfZhANAZdo5R0fe5Cn5z5Fa/SPxAqw5:4Qf9aVv0Vd8JQMmDcZsfZhu6o5K44rFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757705, "uuid": "486bd439-8e3d-492a-a3e3-510464da0483", "value": 3115783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757705, "uuid": "472157b5-e507-4e88-8067-5d6dba901c41", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757705, "uuid": "8bbdfc04-1fa0-421c-a6f7-a9868dd9dbb6", "value": "64109_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25de4f99-fb49-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1628757715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757715, "uuid": "dbc4b4ce-7579-4a94-90cf-c6e715b9883b", "comment": "Malware payload (Hydra)", "value": "e5d247675ac5a1326fead1be2d22cf16", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757715, "uuid": "10277d7a-cc1f-45cf-bcbf-8b66840d32cd", "comment": "Malware payload (Hydra)", "value": "2ba94628cffefb0fc52a5bc61982b5e8dfd2f8afa03bd86030b200ff1c7c1c67", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757715, "uuid": "7e0cd0f5-f668-4a38-9a42-f40b4cc39bfa", "comment": "Malware payload (Hydra)", "value": "2c384fdaa45c5496fc649ae227fa7b5e9ae3e363", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757715, "uuid": "7c477acf-07aa-4471-b6ee-364b5fb2dee2", "comment": "Malware payload (Hydra)", "value": "18028cf4b6c52938830e710708c90a7c4b98502738f64f32ee5a4cf76a4ae84fc9b9f46eb89a38b339f47942f0438d14", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757715, "uuid": "1dc316cd-f90b-4b0e-b457-0b74b750877a", "value": "T159E533DAED25E442DA8BCCB60280859AF206615D1A01BF6F0BF08F15ADD6FE4C753DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757715, "uuid": "39fa28b2-01ce-43ec-9471-84e6e280eaf1", "value": "49152:ZZ3Fhu5v+oeX7tQ0gYZ1r6svkRQYGdHgMjVwAf6BwGf6fkPiK2pFd4MfXqiDo/Jz:ZTYtAZQ4wR7G5g4VbfOVu9FdhvWmkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757715, "uuid": "ba3c02a1-d3cd-405c-82bc-ee09f8a26b01", "value": 3115783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757715, "uuid": "3d8a2b04-661a-4bbb-9c7d-a1b2ff21ba5b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757715, "uuid": "75a96860-a474-4dce-8d45-a604136af3b5", "value": "46129_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a171eb44-fb26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628742890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742890, "uuid": "43e3cc18-26f8-4775-87c0-becfc9aa9e2a", "comment": "Malware payload (Gafgyt)", "value": "8d19260405bb8b06acc0d6e2c7c1bc6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742890, "uuid": "21acaf71-acfa-44fa-a5d9-7b891fc6364e", "comment": "Malware payload (Gafgyt)", "value": "2bc5297800e6389d2a7030e4e497fd981578f7b3d023594893cca083eb224749", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742890, "uuid": "1cd1da8f-a4f7-4ac5-b77b-afad7d526ded", "comment": "Malware payload (Gafgyt)", "value": "56d51fc82b1f0fa309a7a162455a854573df384b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742890, "uuid": "20619166-3640-4782-a477-6a30233ab0b3", "comment": "Malware payload (Gafgyt)", "value": "ffe72e256596e072f557701914775942f77601f27c033abd7877a0782f5bf2bfc7f8835c01da7c88fbdec5e5c3c3961d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742890, "uuid": "85a0cbfb-c674-4a84-8de3-207fc879a054", "value": "T169833B0692518B53C1C2177ABBDF425937236F68D79B331156287FB82F827DD0B2E622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742890, "uuid": "6230f8f9-18ee-4d9d-b663-9c883e6f7f92", "value": "1536:eQnM+yPYIyamtD4iOeBkxbXXBgCe5LY7Y6Do1ZefHy1PrqAC3kOe2:kyaWBkxbXXTeNoY6JfHy1z1CUr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628742890, "uuid": "2ea52069-49ea-4047-bb47-d1fbc2cbde02", "value": 85780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628742890, "uuid": "d854320e-ab22-4526-9a59-3e917ab03c49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742890, "uuid": "e1f1bac2-65f8-47a4-a8e6-8f0d9c366ffe", "value": "8d19260405bb8b06acc0d6e2c7c1bc6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56dcb63-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628756748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756748, "uuid": "566c166f-0b3f-47d1-8ba7-974f20dabd08", "comment": "Malware payload (RaccoonStealer)", "value": "de91f84e9b1a869d1e7890e9bf4d8c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756748, "uuid": "0022411d-7988-4927-8ce2-d4d6a0311f87", "comment": "Malware payload (RaccoonStealer)", "value": "2cb7b724ba108cfab0f07348997e32c7c531084ffd2c9326e6ba51ad8f4ed656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756748, "uuid": "3d8020c1-6351-4e56-8700-b17aad88c297", "comment": "Malware payload (RaccoonStealer)", "value": "10d78089cebab23bf04a9d1502f078077c344176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756748, "uuid": "db3bbd74-fadb-4dfd-8be6-0bb5d5b5a6ff", "comment": "Malware payload (RaccoonStealer)", "value": "cbd365a24d8de39f70691b0297c3b10a3c1234b9e3653e89c6f854bdf6474c6f8a758f3816a87e9663caf6a3d040f8d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756748, "uuid": "6b431a30-429d-407c-919f-c27100d0cb79", "value": "T16A75237277E2C4FBEA815031AE4C6F7126F9C7491A321DDB7794C70D5F38892D22AA48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756748, "uuid": "fa51c812-c51d-4728-baa4-52186b2a57a5", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756748, "uuid": "ad94c47a-9866-4489-9d1e-0da70c4a33ed", "value": "49152:xcBRCpZgu25meQkEwJ84vLRaBtIl9mTVjj1+0:xlZ25m7TCvLUBsKVv1+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756748, "uuid": "28de6494-885a-48eb-ad08-72ff79ab23fe", "value": 1583044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756748, "uuid": "ff69adbd-b480-41b3-b3aa-b008c0b32b9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756748, "uuid": "d36d5d8f-8ea9-4a7e-87cd-7622de5f55c6", "value": "de91f84e9b1a869d1e7890e9bf4d8c3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20898c4a-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628749116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749116, "uuid": "7c325f40-0123-422f-8790-280f57c9de73", "comment": "Malware payload (SnakeKeylogger)", "value": "d2defda859d008199e0318a96e1295e9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749116, "uuid": "36265e61-9655-4fd4-9fee-5c0a261bc055", "comment": "Malware payload (SnakeKeylogger)", "value": "2ce1ce0ff8f63f9fefb0a0fdbe0d725eb60c7ca8350b4ba7fbae2773211e641b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749116, "uuid": "59d21cd4-25ca-400e-b3f4-b8027a1dc5f0", "comment": "Malware payload (SnakeKeylogger)", "value": "4665208ed89015fd5d0d7704a2e2683ae2986e4a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749116, "uuid": "d39ed967-9f9c-4446-a110-b60fe1a0feae", "comment": "Malware payload (SnakeKeylogger)", "value": "89e92a9f5ef51b607d2ffc4b7ebc38907ae7e711c571889dc6ac209fc9ff3b490b172ae9a3437580537697be6fa25f42", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749116, "uuid": "790c5d0a-0c0b-405c-80c2-8072d5b06f12", "value": "T1691431ADC05706C8CF859BB42B1B2F4A104C7B6EF798A532767887762BD1D7E441283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749116, "uuid": "8a7de65b-d678-4c46-99e0-154dafbdbe1b", "value": "192:iDYA8f3oR2oVI+qWr7Sv0i4jSOzzlQWxvgSVXh3nMsNTYK+fyj06fWyA/:i8AxIq7I0uMlXbVlnoK+6ROyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749116, "uuid": "c6d65669-0750-46cd-bc50-4984ed6fb213", "value": 194445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749116, "uuid": "a98d3076-79da-4868-a3bf-98a12d448840", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749116, "uuid": "4c8638eb-245c-435b-89ce-b5cda965ba55", "value": "DHL scan documents_1208021-0830.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904615f9-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628775932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775932, "uuid": "8e4783b4-17f8-4165-8dd4-f8a9db49b599", "comment": "Malware payload (SnakeKeylogger)", "value": "29bf3e3b8745a35d7cd8700eca469f94", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775932, "uuid": "5d053366-25c5-4951-ac0b-5623f7181bca", "comment": "Malware payload (SnakeKeylogger)", "value": "2da8f94d09f6c75da911b6c68e8bcf382579d96fd1a794463152c48ecf1b67de", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775932, "uuid": "2d1a0608-80c7-41c9-8546-3bcd1551b129", "comment": "Malware payload (SnakeKeylogger)", "value": "c5e73d98d363703cda0c68c6fd49a946bad88755", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775932, "uuid": "664a8fcd-c299-43be-aa77-91e0692b6b1c", "comment": "Malware payload (SnakeKeylogger)", "value": "4f026bef591158ef11a4c254458ebc2ba068160570a8aeee2436c06011f6725d203d53340f332369166d79c552508acb", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775932, "uuid": "6439a8ff-a518-49cf-b6ac-f8d7e6261c61", "value": "T1624513B095E04E03E84761B69538DC4D1B38BF82B9AE6279B7177FF60335F3096891A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775932, "uuid": "a8966365-4f1f-4caf-994f-1ba517d30420", "value": "24576:WwcRyh4cbgHKdVcMCNWcB4hUosbx95U3EQmmmmmmmK+mmmmmmmmEjGmoXjQ:WwcRXxKAeURH53kwzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775932, "uuid": "c98fdcf2-5878-403f-8c00-f5ffb13c065f", "value": 1236200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775932, "uuid": "7c9b97ef-516e-4fc3-9fef-e0c7dcb85061", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775932, "uuid": "1f65552e-3d05-40bd-9017-72e1cc52c7ea", "value": "REQUEST FOR QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3e9c76-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749323, "uuid": "01913d70-2aa6-4b6d-a0da-48652b2c6840", "comment": "Malware payload (AgentTesla)", "value": "71e7363b6e0bd826ba13b8188bc5334e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749323, "uuid": "cce5f405-82fb-44e1-a950-ef3222ae423b", "comment": "Malware payload (AgentTesla)", "value": "2dcd52efde18ce05268e8e5cbf8922f4d408e40e3558b5d5a5dec22d793cc799", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749323, "uuid": "7cd79763-c309-4db9-8fb4-87085a020048", "comment": "Malware payload (AgentTesla)", "value": "b6d939ddd6638b1192709c1aeaa0770fa811dc50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749323, "uuid": "aa87cb3d-fb7e-411f-afe0-508402546e82", "comment": "Malware payload (AgentTesla)", "value": "edffdc89a6ddfbbd75889901c4e1b99bb2d105cee54b004ac0bbe6e29345e7cddf741dc18dd065b4303959a03b9e23b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749323, "uuid": "4f8ad51a-0f03-425e-b82a-bdfd0d084e67", "value": "T1CF053365D0D0DA328224C8E17554233C462D75ACA2381A8EE62FD53EB9537939B34F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749323, "uuid": "e6f6de1c-6d4e-4401-9acb-06d7f68dabdb", "value": "12288:K0OSFXMSyk6PO5AeHfUrct+1EgJCvACX7Dk+Io3sHRMwVqWJOKO+oeOkYtihyJFr:KmFXhKO+rv1LJDS7Dk+1cqT1wFZyJ7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749323, "uuid": "94b9c7ba-07d3-4c2d-9607-f91d6601e737", "value": 837317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749323, "uuid": "8c7510a9-c70d-48f9-8523-8ff4eab8cb68", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749323, "uuid": "eac019ca-72aa-43c1-a97d-03ece2646545", "value": "Bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21b50f6-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750192, "uuid": "e29d5097-e117-467f-b136-e67d841fbcce", "comment": "Malware payload", "value": "8792c7a57dd3c390164d2c83ac657edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750192, "uuid": "8e385568-ccd0-4290-acd1-12b46a59bf7c", "comment": "Malware payload", "value": "2e3b767101904dd4352ece4ac162a9253edc02609db93ef70801e3a6fe1268f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750192, "uuid": "735cb539-e8ca-43aa-853b-33a24d05ae7a", "comment": "Malware payload", "value": "73d5bf66a1ee1f0eedc81d2f1d0b1681eab77712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750192, "uuid": "c5e57edc-e865-4b4d-8fe6-2caa7cd9d302", "comment": "Malware payload", "value": "ff665a6ee63ed4d173750064ad5eac9d0220f8f0b6b89ef1219a242d3eb958e3bc8617233744ad235f5f52ebabdfadf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750192, "uuid": "6fe3ebec-b0cf-4ed9-a004-aa8309e57e46", "value": "T153B4CF31BB90C035E4B602F845BA93BCB93D7A60973890CB92D52AFE17345E5AC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750192, "uuid": "041df81e-880d-44d7-8024-1b1759814416", "value": "0b2673717edc4e64b07cfaab3e6cb412", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750192, "uuid": "87af87a8-7d41-4671-a799-f18e47d3b74b", "value": "12288:WQfZXs+klAItaRUcDOgRUUWpoKK3kfNXx2Nddy:Vh8+krwOWXaoKXNXkNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750192, "uuid": "69264d8d-6b60-441f-ad1f-50eb0cd526b2", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750192, "uuid": "9c4dcd13-80d7-4716-8ac8-f04004a5439f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750192, "uuid": "6db50eab-0838-4913-8914-95f087d190ac", "value": "8792c7a57dd3c390164d2c83ac657edb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d46cef2-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767122, "uuid": "cdf9bb30-2b0d-4db6-a18f-ab78f3fea10b", "comment": "Malware payload (Nitro)", "value": "32ecd572dc34bcf8ffd5e5ac5472c46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767122, "uuid": "459b9ad8-0cdc-45a4-a741-16114ca4cd30", "comment": "Malware payload (Nitro)", "value": "2e6aa26a32bf74ac27d91e8ae726f16233831c13d9a61cfa71fa3a223e5c61ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767122, "uuid": "94f52e0b-2951-4d46-90aa-359f7a76bcda", "comment": "Malware payload (Nitro)", "value": "c6dd23d1f6d4b02ca4b4450e6834e27e1c029cc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767122, "uuid": "59b24591-f841-4045-b930-e4735f9fdd03", "comment": "Malware payload (Nitro)", "value": "a66012cc97bfa96913cd8399eca26e2bcaecbb3d81d8d156e44cc8c738b7198bec4bd2af6d4ee48d1d25d34d261eef9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767122, "uuid": "1c91abe5-387a-47bd-8eba-82a6605264bc", "value": "T16E53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767122, "uuid": "4efc8eba-46fa-4dfb-acac-3e84ab92b0ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767122, "uuid": "f7798a92-5412-448c-8178-46d62d765843", "value": "768:vKsMqCXfVcWO/M9ZkiANIUZVYLDwUzc80gmq3oP/oDH:vKseiM9ZkiAPYr/0O8/oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767122, "uuid": "0a6b06c3-bbaf-4f12-ba7a-02a17dcb6f5a", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767122, "uuid": "6e323fbf-deba-4750-a425-ed03920f73d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767122, "uuid": "a79d3873-6eea-4821-977d-31ae2cf53b94", "value": "32ecd572dc34bcf8ffd5e5ac5472c46c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359455c1-fb4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628759459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759459, "uuid": "22b0dab6-7b1f-4d7c-8385-ec6b93959691", "comment": "Malware payload", "value": "10a3219a09d9dae3edc7051a741fbad8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759459, "uuid": "95375dc9-753f-451d-9b17-50af596dca44", "comment": "Malware payload", "value": "2eed07a5f9b30d3b0d8e02c059f3a988c6c6645ecf3c6d50e93056b3164f3c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759459, "uuid": "40a5d165-4761-40a6-9e5c-4a87bc116c1f", "comment": "Malware payload", "value": "5e8567900d35c545d60094a8996f716cb2b9e4f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759459, "uuid": "8a818339-7b7b-4ac4-ab68-7d738f84a416", "comment": "Malware payload", "value": "7bb9ed4e8e94ecce5da17f1a97eb95295d51f13ee6f4a3f170a234f86f456086c65c583b43b9237384d2a5613455a6ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759459, "uuid": "14bbd3bb-9d4f-42ae-800b-8c214f237c69", "value": "T17494CF14B541D073C7A308312AD5D6BB463EAE305F308DCBDB9A5B796F305E2A22477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759459, "uuid": "dee47897-210a-42d8-a79b-545afd63ac06", "value": "211889fbd769218c7de88e900b98c2f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759459, "uuid": "1b7d3df2-00ca-4f70-a515-d5e8de6a557f", "value": "6144:ShvjG8xkNPbKP5iIfh/wWsnw0ixes4QW6cgiPn8giWy0hm/6g/rtkTe9epF:SFSgGPbKhiIfh/wWsn7LqixiF0hmv8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628759459, "uuid": "3e571085-fe09-4dbb-ae23-0be8d9b18c70", "value": 409189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628759459, "uuid": "099095c4-8d95-4dc6-a145-dc615e29abe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759459, "uuid": "bfa9ead8-ac54-42c1-9958-bfa2dc2455ff", "value": "Commercial Invoice PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9837dc4-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750634, "uuid": "fd9e1e90-a988-4fd6-9b17-749c6199b61a", "comment": "Malware payload", "value": "16db53c300e578823bf39b19a30c8dd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750634, "uuid": "3e8e89ef-625a-48dd-86b6-f8077f29cc88", "comment": "Malware payload", "value": "2f1737adaef1fc43ff713ee79cc3438c9497ac5acec681b0a73533d0110e398c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750634, "uuid": "24d38238-e34d-495b-942c-e596212b2a66", "comment": "Malware payload", "value": "0e48389db46e64bf723036a161c9c78e7ee19b39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750634, "uuid": "cb46debc-b2fa-4082-932f-0700552dd1ff", "comment": "Malware payload", "value": "eb3c308797de330be2677a5e812727700167ae66afed8bba6773f9193b5555bb8bc712572792d79195e52ba3aefe690a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750634, "uuid": "44956d2f-d51e-49ea-a5a5-9b16d9cbd1c2", "value": "T16AF4F16976848937C3429D7382C8E1D253A5C40A2B43EB85E0ED8139DF377F5BA639B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750634, "uuid": "9904c4a3-a4e5-488d-924f-5594c66bbe25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750634, "uuid": "6bbe410d-9441-4ef0-8b1e-13f07b041d01", "value": "12288:dHcFZu7/HK7zuZEI6SLRuc8LzFu24sbNi/3vRFTAgfWPpQ:AZuGSZ6Socu7A///VOpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750634, "uuid": "92f14e51-c2fc-47ab-aacd-848e34ab3d56", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750634, "uuid": "623d0ce2-bfc9-446d-921f-f93eb91ba1c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750634, "uuid": "bec72712-7396-4be5-9a78-2c69ab0c5207", "value": "mercy $@.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9b03f0-fb65-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628769782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769782, "uuid": "e526ecbb-c6ce-480b-9f43-1a41c4f0450e", "comment": "Malware payload", "value": "1a064c434ed64e1f24cabdd148738a08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769782, "uuid": "44e89ad7-0aeb-4fa3-969b-08a0512930f9", "comment": "Malware payload", "value": "2f5e1050cf219018d653669b8d153b004d74ef53e8abb9ff531bfe39000aa2cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769782, "uuid": "9b55a74e-fad7-420b-8c24-4cdd4efde5c1", "comment": "Malware payload", "value": "f79a1e69964e70484118b0c50443a13eb8a4e7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769782, "uuid": "e7ed9262-caa5-4af9-8552-f381523fac3e", "comment": "Malware payload", "value": "eba9de9ee5a2e9ab6b73b8804b520fc168c5d3fbe148e1c9245273e8d1d31b334165e98a99f4dd8f9df6baf83a038bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769782, "uuid": "8dd1fed2-44d1-44cc-a2fa-b07d1cb2a29c", "value": "T133D3163263A89B16F67E673A25A0900003F5F52AD333DB4E6DD510ED1E66BC086B7B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769782, "uuid": "fabc736b-a61e-463a-a493-e9bf2328b6de", "value": "3072:nCpR0wSXwdTLKw78PRuIdy9b6Pxp5jc4o9/nT32GhQ:8SXwdTePRuky9bSxPjq972GhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628769782, "uuid": "c64f01d6-7d85-4fd1-9284-7bb82267d3f9", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628769782, "uuid": "6ed5f65a-3324-4c06-a91c-16064fe9b9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769782, "uuid": "06f10090-82ff-4e4f-bfcc-b8fb9a06de8f", "value": "ORC 53174 082021.PDF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff413c5-fb8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628785998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785998, "uuid": "7bbc0004-bef2-45e6-85c1-a6b408e9e3d7", "comment": "Malware payload (Cerberus)", "value": "949a0f0d8d17032e191b2f4abf36ba23", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785998, "uuid": "4275614d-9716-464c-a2a3-2f2a0ccea5fc", "comment": "Malware payload (Cerberus)", "value": "2fa121936551e846d3ca6deeb62b75cfcac4de539dc5f655d09ede5b9a31c167", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785998, "uuid": "9fa4423a-5e27-4ab1-9d47-938d08c7509f", "comment": "Malware payload (Cerberus)", "value": "bd296e2ab7d8cfc918a73f783f9b2f2e14463d23", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785998, "uuid": "99ace6fa-b674-43eb-820e-3ed1f36a596b", "comment": "Malware payload (Cerberus)", "value": "809bcb61afe11995810a15744a0dd391fc82b3c72bdd77425704ab79f3ddf5cccc1f86a20036722c327e33cec73518d8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785998, "uuid": "523e5f56-5854-4d43-a980-8d5277fb521c", "value": "T1BAE5330EE3C2A84CCB4F4373C74321033F6316AA56E5987E172784D598ABD98C757DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785998, "uuid": "57f9d9ec-854b-4b2e-9f30-107b46035809", "value": "49152:HXcsYIcXd4oelpStERK56BbytLeC7HtxkjNCUVxszNmaD0SngimgPKTedGn:H6LmplpU6ButPxWhf0NmaD0rjWdGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628785998, "uuid": "fb4cb9f6-a200-4dba-868c-8b9b4d52d437", "value": 3026667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628785998, "uuid": "dc880af8-9242-4417-b7ef-474ae5a9d575", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785998, "uuid": "bad38a8a-381a-4c3f-9a47-168c479fdaa5", "value": "GIZLI_CEKIM_IFSA_VIDEOLARI.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ed3dcf-fb69-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628771536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771536, "uuid": "a50a9712-cebd-435e-b832-4bccf41e7d37", "comment": "Malware payload (Formbook)", "value": "48a7e4f15c34c49f74e995e8144da054", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771536, "uuid": "6e7a09b8-8e9d-456b-b7f0-187d9d879ac7", "comment": "Malware payload (Formbook)", "value": "2fd37f69250370a2c722444d91ecd0243f6688c27f0fc434652aa4a3816e4631", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771536, "uuid": "19f524cb-1b31-4ca3-9584-3929682b9da4", "comment": "Malware payload (Formbook)", "value": "9f45755e89acad1225af3532dbffc81f7c48429f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771536, "uuid": "cc0cb158-e57c-486d-9b0f-7954e16c8121", "comment": "Malware payload (Formbook)", "value": "27a0f4979d78d1ed179fee1ba7dd80c1bbc0c91b9438ebd5716d2c158a6a36d92aa2eb4e16a0e91a4cc77fcce0720c06", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771536, "uuid": "00f805b1-7a89-4a60-87ac-d581ef0a0045", "value": "T114F4334FE4153BB6FBB5198AE3586AD6236325712DED26E89E200CBFF91C50D03C6316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771536, "uuid": "874fecac-6436-4938-bb6d-a8f332cb5825", "value": "12288:cTeWyV3efKV822d+1KaMB768ZUpYnYtUvIUe9afx2Com/ZGfEQ9Hamz/NmUb3/Az:cfPchSTaMBm8ipX+gUKafYCo0cXx483u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771536, "uuid": "07d24a0a-f54a-495c-852e-d0af1a5f1330", "value": 770597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771536, "uuid": "5df2a183-6938-4c2e-b0cf-1aeb942cd354", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771536, "uuid": "a9127ac9-9ce1-4a58-b603-1ac3e656118d", "value": "siparis.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79b2be5-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628755382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755382, "uuid": "e65e9578-1427-4d22-ab4d-b68b647e3d2c", "comment": "Malware payload (SnakeKeylogger)", "value": "4220b349c4c00a018bb7452434468205", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755382, "uuid": "7244d4fe-14a3-4f3a-9dd1-32ea517d49a3", "comment": "Malware payload (SnakeKeylogger)", "value": "300255f5b9216ec3e80aeb8d74b644f7b8ec836c56eee077c793ae348514dcc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755382, "uuid": "c3ca2951-ac84-4929-9fdd-46bb41a26b99", "comment": "Malware payload (SnakeKeylogger)", "value": "27f06ebaded2463ca1be630869b3ee07ab5f7ff2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755382, "uuid": "9b87427c-eaac-4547-a84b-dda27a89708b", "comment": "Malware payload (SnakeKeylogger)", "value": "2f09a1c42dd3859e35672896f8c81cf88a8ad31ccb9c3f5823acdd4936b96645e8591185d88f5d6483965a6af92fa109", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755382, "uuid": "93521853-7ef5-4975-9fcd-d57a4fa6dc24", "value": "T1C2F4AE9D32A472EFD417CA72DEA41C64EAA1B4B7971BC207901305AD9E0E987CF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755382, "uuid": "13fd5c5f-d7c0-4e28-ac69-d9a6713ad28d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755382, "uuid": "81537976-0cef-4cec-b28c-6dd83900a2f0", "value": "12288:gD/HK7zJaXDYCY6Up2uKdyUwlCsq3cpMJHay6OfA5Vhm3sZ3ooFYEwf6R+D7Zz+q:gelaXUXp2XyUxs+laH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755382, "uuid": "a3eedc31-cff4-40a8-85f2-db6914ff6a0f", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755382, "uuid": "527dcca4-3607-45f3-96b3-a4959ead7f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755382, "uuid": "b01ae8cd-92ae-41eb-8435-7bfce9a9a470", "value": "4220b349c4c00a018bb7452434468205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e33f81-fb26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628742900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742900, "uuid": "4498f478-34a2-49eb-99f4-23e0bb4fc6f0", "comment": "Malware payload (Gafgyt)", "value": "15abe63ae8d2dde6bacd0a8c61561b23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742900, "uuid": "8071af39-3053-42b1-ac90-e412d67f3726", "comment": "Malware payload (Gafgyt)", "value": "311beb3072b69daed131987b999d37e56a6d3f046381193725652479a818dcab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742900, "uuid": "612f078e-5f53-4f33-8725-ee7d8b9ed78c", "comment": "Malware payload (Gafgyt)", "value": "713cbbe89251944c4c94105275bdad0c058f8b06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742900, "uuid": "949114a9-d447-4507-a645-724c782d05af", "comment": "Malware payload (Gafgyt)", "value": "0dcf67ee2bbbab71e27b5262e557cbc0d985349ffd3f11955929e04badd7344c49312223c559654177137a44867bac26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742900, "uuid": "a766f6cb-0fd5-4f81-b449-b32e9b344916", "value": "T102231A02A686C6B7D4832BF606E79B210132F97D1F178F85E32DBCF48B625887227755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742900, "uuid": "1d94fc23-3dc1-4a64-b0f4-fc6c4efbfbb4", "value": "768:ORxm/aDxX7Wq3X5RJrdNW3Jq/BgxSh//Id8Np/EIBkMq0uwcS:kUS9X7PnDA3JquK//IWp/E/DScS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628742900, "uuid": "bd6e361f-af46-4436-8a01-b2a946750dba", "value": 48012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628742900, "uuid": "2795e8dc-677b-4d4a-a20d-4365b9ee6a1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742900, "uuid": "20a6ba5d-2a7a-420b-8a7d-784704f323ec", "value": "15abe63ae8d2dde6bacd0a8c61561b23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4735e0a4-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767220, "uuid": "a9d14c6e-2615-47df-b07a-6f17a281b6c1", "comment": "Malware payload (Nitro)", "value": "95e9c3bbefa543ca925e7699636bb0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767220, "uuid": "f299f9d3-ed64-481d-bb57-0bb148c9307b", "comment": "Malware payload (Nitro)", "value": "329f8b9afd9c32b4afd6602067d7ec87a64cd83cb5945df6d4ed0a7c80e16c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767220, "uuid": "2cc309f3-dbb0-47fb-9fbc-0c6c17770039", "comment": "Malware payload (Nitro)", "value": "167b2604d081b98e85b51bd359c6b0bd169738e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767220, "uuid": "45bdae57-98fb-4e24-9596-8391ba0ffcfa", "comment": "Malware payload (Nitro)", "value": "a87cdc493c3425a604bc8b9beb7d04f3aa1bfc5f9fdc24f90456ce5545c2407f2f418a14bf4258a8bdd1483f03eda49c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767220, "uuid": "27b45e73-6abc-406c-be00-a929f6b18716", "value": "T1225365286273842EC57C81B811FB2F7C2BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767220, "uuid": "313f397e-0f6e-4368-8891-848c949a314f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767220, "uuid": "3d56699f-266a-4901-a635-e6ad98e84adf", "value": "768:gOucKn7n1J2hDMANIUpZvLDwUzc80gmq3oP/oDoDH:gO2oDMAPbr/0O8/osDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767220, "uuid": "9bf53a91-053c-4e66-b035-eb54eaaf05b9", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767220, "uuid": "5e7cad72-a6be-4c00-8e70-9e7aded79a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767220, "uuid": "1d1639aa-4662-41b2-b637-3a4ec0f823a5", "value": "95e9c3bbefa543ca925e7699636bb0c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff9795d-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1628750215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750215, "uuid": "e59b4158-8414-4885-b880-ad1e61ad4b46", "comment": "Malware payload (STRRAT)", "value": "9f431f7105d073752fd396105dc898ef", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750215, "uuid": "9d886142-0522-43d4-a39e-fa55a453acac", "comment": "Malware payload (STRRAT)", "value": "32cbcd636b3295b79872dc883f84bd3c5f378f9e2bd64a73148e8a3d5d6d58f9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750215, "uuid": "3b23ed3c-1e61-4dfb-8c1d-0d3199261a0c", "comment": "Malware payload (STRRAT)", "value": "62058bd9d3683d7a6983d36722fede080b87c3d3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750215, "uuid": "29321574-2f40-4b67-823d-5c9765c1c6c3", "comment": "Malware payload (STRRAT)", "value": "91cb6bf3a64e7f8ab010ed0552ad4720307ffd2ea67025e4c65cf609ef3dc10fde307dde242514019f3fd2658ebd864f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750215, "uuid": "a2ee5e10-eb7c-4c3e-836d-d0b5eec16a42", "value": "T10993D00BBDA6D9E5D50F96764088F937650C418EFE44A62B18FD4C8B5C72C790712E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750215, "uuid": "54cadd7e-b973-433c-aebb-fc8451fb5d0b", "value": "1536:Ex4jk2LwtGGBCRLwZ0MQ6i98iZGmAT5hSXx93uf3gdTsypX7GufP16wzInBvOwv:VjLwtGLi0MQ6iS8ATo9efwfplP11zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750215, "uuid": "22bf4fcd-b8b3-417f-89a3-411528acb9f5", "value": 96727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750215, "uuid": "d5122400-be97-4e1d-b36b-ef53d30c7ed3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750215, "uuid": "53cf389a-6442-49ce-8faa-47123f95667a", "value": "doc20210812876462PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bd458a-fb95-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628790415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790415, "uuid": "c2288484-1c71-4dfc-830f-6b9b98f6fc0d", "comment": "Malware payload (Smoke Loader)", "value": "11d78b3213fed074105a359c6ef2ffc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790415, "uuid": "0f59ff39-ff62-4ca6-9f0e-9048fcff9e30", "comment": "Malware payload (Smoke Loader)", "value": "32cf0e4532d6617a76a22f45edfe5d10ecbaf10040cedffdb2cea5126b6ff053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790415, "uuid": "b51bd2ac-dac6-4a79-994c-dbcc817d5402", "comment": "Malware payload (Smoke Loader)", "value": "4b247f751854d7a25ebe900aac13ef20f86b420e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790415, "uuid": "395c052c-42d1-423c-8ac1-ac6baed943ef", "comment": "Malware payload (Smoke Loader)", "value": "fdd4483a69d3715e25437f3763569fa689709ab09188cb637f5da23b8ae5da9b5f753ecf2872810b96f7a154ef34c045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790415, "uuid": "39968ca8-e0f5-4120-a9a2-7d359a39094c", "value": "T1A6649E30B790C434E5BA12F849BA93BDA92C3A705B3491CF66D42AEE57346E4EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790415, "uuid": "8ce9cdc3-cdda-4232-985d-b3b66b6a37fd", "value": "be9d626a60a6fc67184535597932bcbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790415, "uuid": "c604f2ec-d714-44c1-b50f-d4aed93b6e28", "value": "6144:EINKTiPWr2O52F3EpK5CvG2YfF5vyxFI9swgZDB7j495HiXk+T/q:XK22J2F3EpK5tlfF5qx8TGnoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628790415, "uuid": "6f47751d-8d4a-4539-8d7a-d64c4bb1c240", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628790415, "uuid": "f93aa5f6-ed61-4c14-a89c-a4aa58bf1967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790415, "uuid": "cefc95a6-a2d7-4244-947d-329260c43901", "value": "11d78b3213fed074105a359c6ef2ffc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f7de30-fba4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628796740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628796740, "uuid": "111c21e9-4c85-4422-a77e-091514eb0956", "comment": "Malware payload (AZORult)", "value": "af2ee0b683302aedb51ba90fde89e947", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628796740, "uuid": "1e8ffffd-53fe-4dde-b141-122bbf6a4652", "comment": "Malware payload (AZORult)", "value": "335cf91959d1dcb04c2e68431300d06a62035e31daba1d19dbfcca0aa398bda2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628796740, "uuid": "37a636b3-919b-4435-aaf7-5322f914c83c", "comment": "Malware payload (AZORult)", "value": "995f559ee21c5c0efd2073f5d050baeb2803b65b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628796740, "uuid": "74edd9bc-a1f1-40f3-9352-adfc9682ee12", "comment": "Malware payload (AZORult)", "value": "b3bab641a60981b244c682f7897a59d8e9a82cb680c9bdbea1f3c89a4761091ba70ad2665664a967d3bb6f912eb94273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628796740, "uuid": "4a98cc4b-a3c5-4a28-9a73-d876116cf4d8", "value": "T10F74020666C7B612CA98043388F7242453B6E74B51B3FBDD3C1881E97F0BAE96BC4759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628796740, "uuid": "567b96e1-c580-4acd-a585-c148785183eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628796740, "uuid": "14594186-b4f8-4135-b329-09d603df0bd2", "value": "6144:VJR+D/4IPQyhfTcGoJntcOZhs+MGxZZMGY3PJ9wc4lwwMqq63J:/R+sIIyh7cGutcAMGxZuGY7wc6kqqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628796740, "uuid": "92a96270-492e-4415-891c-91850a088e6b", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628796740, "uuid": "32914e55-8c9f-422a-aa4a-55c4bdac5cd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628796740, "uuid": "221b39b4-11b9-4f56-8239-5bc0c8fddbde", "value": "af2ee0b683302aedb51ba90fde89e947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0907ef45-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767115, "uuid": "7587d9c9-c791-4c61-af9d-a2bb96899d89", "comment": "Malware payload (Nitro)", "value": "28c6930ca323e61d91b92e4bb843d0bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767115, "uuid": "37f8a632-2255-46b0-b5e1-fee9df54546f", "comment": "Malware payload (Nitro)", "value": "33ee355f77eef2768f6f5e210f008eb78e396f4adc97f090124ced1100507679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767115, "uuid": "c382fee9-c942-414a-8837-3b21dfa6b816", "comment": "Malware payload (Nitro)", "value": "a2699d09bc912dff2cce4f1ebb1ad5e5dc470cf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767115, "uuid": "99be0ca9-cb15-4035-a0cf-4051c997327e", "comment": "Malware payload (Nitro)", "value": "e7f877e3a67c629dadda3734d1eebd5615ad19c858c22055a76f9e8a55edf25f643ffd582c48b17b39e148c00c9af435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767115, "uuid": "684cc891-9ccf-432c-93db-9732228d3ab0", "value": "T1585354286173882EC87C91B815FB2FBC17B0AF156460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767115, "uuid": "fb9db7f5-26ee-43a3-9a10-5a42c8274bcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767115, "uuid": "59afa968-89ea-4a8e-bb7c-82fbc0933040", "value": "768:38ljT2GRLVbGQ8GcYxR8zD8LDwUzc80gmq3oP/oD0:38NxVD8GcYbr/0O8/oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767115, "uuid": "0507fd30-8024-4944-87ac-5b9af4678f4c", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767115, "uuid": "99e23532-5c7c-4425-9b82-4a2cf904047e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767115, "uuid": "708173f1-2166-4102-9e30-c577186c1ce5", "value": "28c6930ca323e61d91b92e4bb843d0bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840cfa40-fb6f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628774194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774194, "uuid": "b9c8c287-43a2-41da-a626-48976b91f1f1", "comment": "Malware payload (AsyncRAT)", "value": "81fd3e1508b299d1ead7d1edcb23f62d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774194, "uuid": "1db79a4b-b810-4267-b90b-5460937607b6", "comment": "Malware payload (AsyncRAT)", "value": "33ffbdee3a0b1a413349f0b2ad1e6507185c89096b1590910969466da502528d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774194, "uuid": "f2189714-6a93-42e5-ac3a-30981f8b156e", "comment": "Malware payload (AsyncRAT)", "value": "6b1da1e345f40396e70a874804c4671a5105b093", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774194, "uuid": "963d2caa-ace1-419f-9cd8-3a80a41edc2c", "comment": "Malware payload (AsyncRAT)", "value": "796f3d1e7dc18725ee03bb0bcc1087d5c79c4893be31f878e60a1dccb999353c31f4d0a882817f1a4b13bd1867a4104d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774194, "uuid": "90ac4a0a-fa74-4b58-86e0-0390d31cf927", "value": "T1BC634A15378989A7F3FE8FB894F161014778E6132503E38A1ED4C0EA1613BD69A527FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774194, "uuid": "2ab21726-c03d-4f25-b420-51674b735dc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774194, "uuid": "9aba0363-011c-4ce7-909f-41dbe1ed81ac", "value": "1536:mDPVvuB3qCddd1Bmn9b9yYFgfYG2p3kf+:mDts3qYmn9b9pgfYGzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628774194, "uuid": "6aac80ed-a0bf-4551-8b44-364163502ef0", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628774194, "uuid": "81d49533-bea6-48bc-9bd4-9192a8d1cadf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774194, "uuid": "1db12bc6-2f97-4698-abc4-639cfa442371", "value": "33FFBDEE3A0B1A413349F0B2AD1E6507185C89096B159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe91c53-fbac-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628800520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628800520, "uuid": "45c44d16-f273-43a9-9823-8e1eeafe1d71", "comment": "Malware payload", "value": "0a0115076c884b0f84d17101ec8c940a", "object_relation": "md5", "Tag": [ { "name": "PowerShellInvokeSocksProxy", "colour": "#7029F2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628800520, "uuid": "74fabbc7-a144-401e-8800-0e468d8c4d8c", "comment": "Malware payload", "value": "35603578a89585712b325f88d3342ee58aa896e872b5ab675a07baf1e87d837a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellInvokeSocksProxy", "colour": "#7029F2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628800520, "uuid": "71dbde4e-abae-4ee3-b583-1341a574f0f3", "comment": "Malware payload", "value": "d20e00db5cc0c8ce6a71ad2539f42e6692a81352", "object_relation": "sha1", "Tag": [ { "name": "PowerShellInvokeSocksProxy", "colour": "#7029F2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628800520, "uuid": "b734563e-5467-43b3-b61e-dac83c97841b", "comment": "Malware payload", "value": "7cb9587ee3a641079426287ab46a2b489a18c4ba63f6df7c60cd94402a007cd21d6db86a1bae4bd26ef2dafe4eb4fa09", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellInvokeSocksProxy", "colour": "#7029F2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628800520, "uuid": "0cd92822-ea97-4706-9afb-221722429cbc", "value": "T1B422FC0D7B49990109B7725AD74EF55DE421D68721AA8C00BB9CC3D71FB4808CF59EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628800520, "uuid": "5c8e7e18-eea3-430e-bdf6-284ec718d58b", "value": "192:zlZfP2PO1K+x+iUQB9TeKGHi3YYBfwe+N+tZeKmaTcfVtN:zlZfPt3oixdeK4ioA4e+N+tZR1Tsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628800520, "uuid": "650add4a-4d94-43f2-8048-156477da4fa1", "value": 10725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628800520, "uuid": "6758196d-77c9-46fb-ac38-1de99e73d100", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628800520, "uuid": "2ba6e82d-fced-4b6c-9a45-3b4c0fad3154", "value": "5qEUBuB9.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca7b8e7-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628776141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776141, "uuid": "9ce80476-43ff-4960-9251-93abd68acaf1", "comment": "Malware payload", "value": "067d941e196ccc522d052318dbad1acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776141, "uuid": "9be4dba8-7a24-4379-8e69-92d3201c6c0d", "comment": "Malware payload", "value": "35f0fd2e322b088525d860105208e5cdd39f85b0016b56d9e76cff8bbc542179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776141, "uuid": "7d689234-e37b-4c89-b217-f2c58a4bbe5d", "comment": "Malware payload", "value": "39f957ced18762e221a0b5510ed49c6ed336e3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776141, "uuid": "8277d6c5-f2c1-4f78-a9e7-9d585cd2f748", "comment": "Malware payload", "value": "4960f2ddf7cb491d9dc3ef4e378ab8f94d4ad1477a54764eb5837cec89cd6dab1b4093a14778446fd09221d39b8c99d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776141, "uuid": "bf479895-fd42-480e-ab6c-839da6e02bb9", "value": "T1B3B4D030FA91C431E5B701FC45BA937CA62C7EA19B3440CF52D52AEE57346E8AC316A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776141, "uuid": "487e3c34-f842-40cb-8cdc-a7615ea2f919", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776141, "uuid": "ddcb866c-39df-497a-b2a8-f7ed5c0aef4b", "value": "12288:4Q/+XWikTVZ6bBBcYV0yNcReuQQ8SZ9N9WPNsFsy:j2GikHWVzccGXNwPNsFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776141, "uuid": "70d4aa08-22ce-4e8e-908e-748646d460f3", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776141, "uuid": "0c163f2a-0b85-4d88-9674-20d3928607a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776141, "uuid": "aec36f5f-c2f3-43a8-87b6-45b85e59b49b", "value": "067d941e196ccc522d052318dbad1acc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3abeaff-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767509, "uuid": "eaa612ae-acfb-4074-aca2-b669bd3d96d2", "comment": "Malware payload (Nitro)", "value": "ab78549639f9320cfb451e88a6226f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767509, "uuid": "d71eef00-ec6c-4d26-9b4a-ba8c6f34f72b", "comment": "Malware payload (Nitro)", "value": "36444c4cf344fcd77f1aadd7d848883e75fe74dbf01e2067ff0e9c3f1caf0157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767509, "uuid": "f2ace066-e48d-4acb-a91d-01fcf7a07c87", "comment": "Malware payload (Nitro)", "value": "22966d795e19423d776dfcb920c33896a7b03edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767509, "uuid": "c0b906d5-1db9-4171-b5d3-2e51bda94f7e", "comment": "Malware payload (Nitro)", "value": "f1445882412ea2b6a58bdcb04d657184c14088eeb9ab11ed1c873bcf10552f7503fd0626e45e14e591608dc7dc5778c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767509, "uuid": "e500919d-1dba-4e57-8d33-0d4cfa9606c1", "value": "T15753532851738A2DC47C82B815FB2F7C27B0AF566460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767509, "uuid": "00e667b8-e968-45c8-839a-902a20fda87b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767509, "uuid": "6973d25b-1ddc-4030-8d2a-625f2c7ab3d6", "value": "768:8KsMqCXfVcKzRpirRtoANIUBLsLDwUzc80gmq3oP/oDs:8Ks6RpiNtoAPar/0O8/og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767509, "uuid": "df8a0704-f3fd-4618-83f7-d972ff9e1309", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767509, "uuid": "ad913c5d-36be-45ce-8d4b-741a7e8c69c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767509, "uuid": "013e9f75-9080-4387-b542-8443a879b986", "value": "ab78549639f9320cfb451e88a6226f03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711b5fa1-fb70-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628774591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774591, "uuid": "e63175d0-305b-458f-9a9d-e225192bfae7", "comment": "Malware payload (AgentTesla)", "value": "fed71b10b7e687e2a79d50d54432825c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774591, "uuid": "8cba6bac-cc18-4164-9ee0-3978273ea50e", "comment": "Malware payload (AgentTesla)", "value": "373d7750fb5c6c9a20651b2267fa23840da0a288f62bed277ec1560ba1d7bab7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774591, "uuid": "a9ff44bb-a41a-496f-ba47-fe97f221d9d7", "comment": "Malware payload (AgentTesla)", "value": "271748f737c25ccde7403c57afc342a41bf7de99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774591, "uuid": "8e2b94bf-610a-4ea5-844d-0a8bef7d851f", "comment": "Malware payload (AgentTesla)", "value": "6e1727c4b78b6048e95b994bb6501dff0ac2c83e81632d892be8b6a47c0f3cd2e91c7a9cbfa3ca69b0c73b13d156bbf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774591, "uuid": "a32a6055-b3d5-468e-af59-a0e13170f6c9", "value": "T10805BF9C32A476EFD857CA76CEA41C60EB6174B7571BC207902305AD9E0E98BCF146F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774591, "uuid": "05004f07-6541-49fe-bcfe-84c82d684127", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774591, "uuid": "07cf45af-029a-4062-aaef-6107a97f1d6d", "value": "12288:NXm8Ag2J/HK7z0nAAXCnZd3LjKopJjVjmvKPLmSSthINfOlMg5PfR2bMl2g+3tm7:thAgDHAXCnvmO7zPLmSSoAln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628774591, "uuid": "3d9bcc85-7e4d-4e44-b9c7-8eea9ce02379", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628774591, "uuid": "b7fcebb1-0994-44a9-bcec-f0203acdd051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774591, "uuid": "c806e3dd-94c4-41b1-8b8b-ed0de72b0c27", "value": "PURCHASE ORDER#25467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2f1679-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628750155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750155, "uuid": "c7992ab7-a638-466b-86cc-632925ec5f9c", "comment": "Malware payload (Formbook)", "value": "bb367436118b3298affddea50440ac12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750155, "uuid": "e40142bd-59ee-4b1d-b0e6-70e9ad3a852b", "comment": "Malware payload (Formbook)", "value": "37f6df44b9dd38408fe5682c6d660eceb04a2915b3420576afce05bf3076bc01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750155, "uuid": "0c52f6df-3b91-4a39-ab6f-bb3a4022ca32", "comment": "Malware payload (Formbook)", "value": "b2b8d261784991e3c14c6577447362cb6d72634c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750155, "uuid": "e5c1391a-dbec-477e-b904-9479913f7fb4", "comment": "Malware payload (Formbook)", "value": "d2a2850f5bd8b7d1e2da9999e517268864e4a107668367e0e1a01bfd34a4589763f542d068069b91fa3e1a780dcc7c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750155, "uuid": "5da41aca-3b31-414a-a512-04aa3e06bd8b", "value": "T19265D43C29B92627D1BAC375CBE59827F4409CAF3551BD94A4CA73660372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750155, "uuid": "c2ddfa03-151d-4f03-9d9a-6135ae65d607", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750155, "uuid": "412de8ee-d8bc-41ca-9b05-279d1102a6d4", "value": "12288:3JdXpDQCEm+SSboh6Htaw0gjLozE+LiBUVtfX/KT2fX1k/HmUVpGF9EVxlm:3JDBCh82j0zE+LiIKT2fX1vOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750155, "uuid": "53b10665-96f3-4caa-af63-b1e62dc7ef67", "value": 1453568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750155, "uuid": "10617fa5-e91f-45c2-a498-8dc5fd329429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750155, "uuid": "3f6ea95b-33b6-4593-ac0b-8e498d66a2ba", "value": "bb367436118b3298affddea50440ac12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62ad37b-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628738683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738683, "uuid": "ddc7fad3-8237-410d-a622-e0036fe2120b", "comment": "Malware payload (Gafgyt)", "value": "2512a963faff360fa6f429c5d770eea9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738683, "uuid": "3a189ca9-2145-444d-ab3e-d1784361e248", "comment": "Malware payload (Gafgyt)", "value": "38c2c0045be99101cfffec61e72d0d248e0f8878afd06579a55e8b46a499b007", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738683, "uuid": "a5d46a87-4def-4461-b8c8-2df64b18fa38", "comment": "Malware payload (Gafgyt)", "value": "b1a38050a4a6f1fc0dc3857f4f5dc4cb357642ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738683, "uuid": "90815b24-1eba-45c9-8428-bc8ebf2608c4", "comment": "Malware payload (Gafgyt)", "value": "bcdc0aefb48a57ee5da2e08ae7b3047604d5a1bd167502e568ef27fd7ee6ca5daac1201251ea2d145aa05e2071b9a35f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738683, "uuid": "1f2b925b-6316-4add-a2e7-260ad94facbd", "value": "T13C930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738683, "uuid": "d72eda2c-7d81-4c0c-a3ef-abba0614b159", "value": "1536:LBkF9VQPAGZHYyEfgcqpq1innPTxHOxdePczYrmREqQ4b/X7XSee:OQFHYBv1WTgePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738683, "uuid": "d0d46aa6-bb80-4c2f-b9f2-d0eed7197258", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738683, "uuid": "4cdf663c-df79-4ca3-b8ad-b8a45805e3bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738683, "uuid": "adb749f6-62b8-4b61-9264-51bf6c2702dc", "value": "2512a963faff360fa6f429c5d770eea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3869fb85-fb8a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BazaLoader)", "timestamp": 1628785663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785663, "uuid": "9d777457-4934-4b78-8114-77179f468d3a", "comment": "Malware payload (BazaLoader)", "value": "a596169960aeede1bab8ee6fea3cac49", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785663, "uuid": "a8d8ee71-e571-4dbd-80c8-9cb53f803676", "comment": "Malware payload (BazaLoader)", "value": "390145df647bf727bd629c4c4c77a211c0776f6b03eec501c35c377ed520165c", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785663, "uuid": "028947ba-6ed2-49fa-860e-989b094bb35c", "comment": "Malware payload (BazaLoader)", "value": "94411a43f529e7918583fe38b3c01a98677b5ab8", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785663, "uuid": "1882acc0-743c-4f11-8bd0-220de3387e1d", "comment": "Malware payload (BazaLoader)", "value": "672a6f912c25c59d5e1c5241d4f345e05a2c1ae159a886974d09316eabb8880d789db47212904c748ec46bc8238eb04b", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785663, "uuid": "62993c43-f695-4d18-9d86-59d5324fcbca", "value": "T117545BA8A144D4CBF9E7ACBCDAE8B3E6F4B67F350F25C1D36EB044115A202919D1A713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785663, "uuid": "65af47f6-78c3-4f8e-a2e0-07c6db778e37", "value": "3072:p6QlU5T0+vk+wYDgN3XwmbvV4Ynnbe9rhNifQMpnIjZ9jAPUn4CbwKL0Fo3dgqTx:pXEwZSZeKZVA6BNL0F1h31eMgIf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628785663, "uuid": "90a22903-cbc3-4899-8bd5-a1957ae1c9a0", "value": 295552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628785663, "uuid": "6297d728-b94d-4fc0-9ed3-ca7f6ee27489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785663, "uuid": "5b4447dc-6dc0-4ab8-8c44-7e09be3ba7ce", "value": "hut10.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136f0804-fb6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628773575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773575, "uuid": "24a51027-97ad-4fa7-9deb-6590c3ca164e", "comment": "Malware payload (AZORult)", "value": "80784f4118d7c4d54dd555436fbd5213", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773575, "uuid": "cae6aae9-c538-4207-b27a-4896ea77a670", "comment": "Malware payload (AZORult)", "value": "390724bb7df37d40b8028f27ee101903256f930df0795fe88b9f7a4ddd6a46d1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773575, "uuid": "3cc8fa11-8300-48ba-8e78-cef84e11e604", "comment": "Malware payload (AZORult)", "value": "dd0a5e46cbd2daa4088ec0185a9f1ba238fe4ba8", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773575, "uuid": "d48b1ba2-8fe5-4e10-b939-0f64612f1bcb", "comment": "Malware payload (AZORult)", "value": "f5e07e56ececd6e20b124a0f3a696856bfa3b6a9751762d15e8c54e355da972450d8aa7b2b72655f847ab9aec69002b1", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773575, "uuid": "e5d56ffd-a31f-4aee-aee5-02c73a98d389", "value": "T12C34E1123AE1A472F2F7023668B4AB424A7FFD525E719E4B3798018E5E311C15F36B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773575, "uuid": "435bf3e0-4cdc-42ce-b185-5b6c384ff6bb", "value": "02a5bae9a8b75693e1b53d76650592c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773575, "uuid": "3be5a1ac-db30-4082-97d4-1bc8699515bc", "value": "6144:42ASK7jM2Aqye3575wB/WarzFWIgc7zCw:Ov7L6a5+BXzFWHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628773575, "uuid": "30ed8cec-64cd-4ada-9ae0-e6e90045ebf8", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628773575, "uuid": "5ebfa459-1ca4-4a02-ad56-94d53bd1bb89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773575, "uuid": "3b2193cb-15aa-44c0-8a34-957229fa636b", "value": "390724BB7DF37D40B8028F27EE101903256F930DF0795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afe9ae6-fb3f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628753375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753375, "uuid": "41707ffe-ecc7-45c8-8cae-c9e668f0ed63", "comment": "Malware payload", "value": "fc525093844bee676c18d9a5f39d4b00", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753375, "uuid": "70cd9f24-6cf3-4d3a-9443-51da087f7206", "comment": "Malware payload", "value": "39a648d2a1e438da1c387ee74a304265c3d7c4ca80bbcfcc6ec56b63af312954", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753375, "uuid": "189f66fa-7cec-45f0-967c-662b04bb17ec", "comment": "Malware payload", "value": "450e8a909c6199c9dd04585b4971e540c3024038", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753375, "uuid": "983090f1-c17d-4c4b-a2b8-b2787e7af722", "comment": "Malware payload", "value": "e4d0c2ded0a8d2062b1790069232dd4e3887d8907b4523f91d71b1a2556d624780131353ab829d84312921a91f4619e6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753375, "uuid": "2c52bcbf-f3c9-4204-b32e-9d4f484139c2", "value": "T1F77413E1D2D4C6C9D4E1607E56F10AE9236EDC75E125DEC78952E000AB7A2C6CD223FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753375, "uuid": "ddfeb250-9190-4625-b025-4f92e3dadea8", "value": "6144:Qo9HMInvpPbR/5L4YvQ6bgcsEEmi+efMi0oGGPIVYDzFnppbaj4M7+d0:Qo9tRbtp4Wl8cnEQeNGGAVYnFnppbalL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628753375, "uuid": "00734215-915a-4ee5-a6d2-e2f18e783d27", "value": 361837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628753375, "uuid": "d8c64620-3f4c-461a-ab96-0cf7d3b4e371", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753375, "uuid": "d6185006-e07c-4e09-8a30-9592b0542a86", "value": "V0N Charge 2021.08.11.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1725bbf7-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767139, "uuid": "3fa3f2d3-75d6-460f-b32d-43c72f9630df", "comment": "Malware payload (Nitro)", "value": "043fbd84e0a00c3fbf71b88a3e2739bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767139, "uuid": "c716813a-4661-44c8-b2b1-10ade55aaa11", "comment": "Malware payload (Nitro)", "value": "39c7f0761cb71570fc1a3dda81f18f97ac6d58e15b7b24cdadc9cf60dffd18a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767139, "uuid": "3d928001-4db0-4dc1-b1e0-1ed83e66309c", "comment": "Malware payload (Nitro)", "value": "02f42bcab70e675d309a89b34125461cde1a7ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767139, "uuid": "53c13571-bfff-4a74-884e-553928bab9f1", "comment": "Malware payload (Nitro)", "value": "cdec91d64da98d2106715b781e59821aa2310bd6b72c3b559fd1de10c9ce69a551a5cc56bb89e14bd8764b0f109dcb0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767139, "uuid": "944dabdc-711c-4216-abb6-469badeecbbd", "value": "T12F5365286273842EC57C81B811FB2F7C2BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767139, "uuid": "74f33b72-5540-4bd7-aea6-9272212298a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767139, "uuid": "92536cfd-e047-4422-993b-f8ccbda1f142", "value": "768:mOucKn7n1JXDNANIUNbvLDwUzc80gmq3oP/oDk:mO2XDNAPNr/0O8/og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767139, "uuid": "8040686d-731b-408a-9933-0b63fb9c555c", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767139, "uuid": "14d6b293-1054-4877-829a-5b025e04a35c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767139, "uuid": "cdcd2a59-b3fe-42a9-9450-b637a9cc3330", "value": "043fbd84e0a00c3fbf71b88a3e2739bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636768de-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628750516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750516, "uuid": "92066a8c-8a79-421a-abc3-26547eede80b", "comment": "Malware payload (Loki)", "value": "40f1488d00e717a1d31f48477361ddee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750516, "uuid": "09f2fd54-9e3a-417f-b8ee-81db27b4217b", "comment": "Malware payload (Loki)", "value": "3a21143ed26feb405bc5eee9c81929b66d6ba41583b3b1d419a1d6f3edefed84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750516, "uuid": "e052335d-b1cc-441f-9b61-c05d5caa2cf3", "comment": "Malware payload (Loki)", "value": "63b3f7851830c85e2e23762e39010df6b5b2b39d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750516, "uuid": "4e0a1d9f-fee0-461f-98fd-126ed0cf56e5", "comment": "Malware payload (Loki)", "value": "28610ae9289d11143667d243d421ee6788a88130db9a96818c497c05ece9e7683aca1bf7dba167de65c2305407a183b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750516, "uuid": "23eab81f-5176-40b5-9540-486d4bb3c8b0", "value": "T19BD402452BD85B66F87E2BB64A52708203F6E1875F73D91F6DC414EA0F27F048B22762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750516, "uuid": "d4b01838-3fc4-4ba0-9741-76a40d410fc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750516, "uuid": "effa6d19-816c-4fff-92af-436065e6e4c5", "value": "12288:QLB/HK7zIOiRb+J6s4QSuwo7wXXFq4zyhVr3Obcvt2p:x81Rhs4QSBXY4zyhIAtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750516, "uuid": "da395d21-f545-46cc-9eef-fbe8205b192d", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750516, "uuid": "e39f2655-5508-4457-bdf9-89d79cb801a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750516, "uuid": "2e3332f9-35ef-42a4-bada-6c2ffefa3139", "value": "40f1488d00e717a1d31f48477361ddee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972906a6-fb32-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628748026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748026, "uuid": "345ccb55-1124-45d9-a046-afbb772eb06d", "comment": "Malware payload (RemcosRAT)", "value": "cee155acb6add72c39b2bf42531b394f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748026, "uuid": "772711ba-4472-4637-8f9e-176e3140a516", "comment": "Malware payload (RemcosRAT)", "value": "3ac3f0eb1fcb322fa443d10336246851f58eaab7202803867241d36ba2a80c67", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748026, "uuid": "7879b8cf-0042-4070-8d0c-fabbb67d88f0", "comment": "Malware payload (RemcosRAT)", "value": "8c71b591f9772eb2fde742901be0cd2785218c70", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748026, "uuid": "7d3bc5fa-69b1-4e2e-a86e-9b47e5d03f0c", "comment": "Malware payload (RemcosRAT)", "value": "bf9b6bfd6013e743b215e3e492c9954f56d911b79d0eb0335dcf5e5dbcc9b4a40574d97a5b5293d3a68a6e8ee90e21e9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748026, "uuid": "df8931d2-6c15-4d34-bf73-543641cb7ca5", "value": "T10B15338DC5E476F78CA858940CCA75E13A01A35DD1D4F9E2B3B79C0439EB906DC0EAA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748026, "uuid": "3b5bee59-8323-47b9-8fe3-cb3e682ac2ab", "value": "24576:jBuXhF7esrtVXbgBTx91GJw7l/61FuohX:jEZXsz91GJws1FThX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748026, "uuid": "faffe175-87cf-4c13-a71a-8142ba3810a1", "value": 917036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748026, "uuid": "68d3da26-abe9-47fb-a153-c35d43b2db4e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748026, "uuid": "bf65b116-cd8d-4e17-b9b9-b7fd34019339", "value": "BR8909894.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d382ca3-fb03-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628727609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727609, "uuid": "107ccd1a-ffac-4ec7-89d9-c6f9b37554ef", "comment": "Malware payload (Mirai)", "value": "4eb2356c3b7d4f73a9bfd1c88fa1a272", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727609, "uuid": "ce5a4580-837e-4c21-8f9d-e295103ef603", "comment": "Malware payload (Mirai)", "value": "3b36ccf0d3e778aaa364dd89ce1ff350beac039d90b5065b9fbe717477f2f68b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727609, "uuid": "317d49dd-2ce9-4b67-9a23-48afe33ecf54", "comment": "Malware payload (Mirai)", "value": "e80f74ae86a9a02f744cadcd77173f9b888d4344", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727609, "uuid": "1856577c-7b7a-4ed2-a49e-0caf51018c6c", "comment": "Malware payload (Mirai)", "value": "1f4513b73e46fbd84f4547a751274ebb18528f786fde002909a3b219ef1541aa635763e5a465da70b685525c80ccdadd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727609, "uuid": "9bfbc963-398e-41b1-8ec1-8495a23e06a7", "value": "T16193A51A7E258FBCF799863507B78E22965837C62BF1C141E19CEA015EB024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727609, "uuid": "4797ecbf-fa5d-40d1-9265-8ca1cbe88ff5", "value": "1536:AKzqmzfphPukFhyxCXgHUveFz0H/DZ5mHZXvEY2QPUy:AKqYhuezWUveFwHF5mHZXvEzId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628727609, "uuid": "780a6bfc-5f59-4c41-9b38-4101dfa87f25", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628727609, "uuid": "b4aece23-be49-4eff-824b-02f9d0216fdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727609, "uuid": "b61dec38-0980-4a42-809d-5753ff070ee6", "value": "4eb2356c3b7d4f73a9bfd1c88fa1a272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd507606-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767444, "uuid": "5f914c0c-9d04-4e54-b9ef-03cab79b1cfb", "comment": "Malware payload (Nitro)", "value": "88863861e03c74eb9b3015e95df10475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767444, "uuid": "27b755d7-5808-4ec4-b808-53394f48c473", "comment": "Malware payload (Nitro)", "value": "3b4f7181d275f3a1551fb024f6d054f01a565291d7739741c4278a0d26e00ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767444, "uuid": "88487d40-f7ca-42f0-83d9-717c513c9a51", "comment": "Malware payload (Nitro)", "value": "e4b6a008352c6cf89499d484da3646e105a5e3bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767444, "uuid": "4a4d01ca-9c1d-4912-9c69-e0ef57c2a47f", "comment": "Malware payload (Nitro)", "value": "11a1d0b9de62b05a07170d3dc17ef16fddf7a41b1ec03921bf5007a1fc2f894867b241791f55d47419329e89d0b8fbb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767444, "uuid": "dbbbd3b7-3e1e-4afd-ada8-7bebee72984f", "value": "T1705364286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767444, "uuid": "decfcb55-dd0b-41ce-9928-f11d5c95e744", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767444, "uuid": "1db30365-304d-4005-b0c6-e3575b0ec9d7", "value": "768:TOucKn7n1JGDtANIUD75SGLDwUzc80gmq3oP/oDl:TO2GDtAPD/r/0O8/oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767444, "uuid": "3e44193d-35cb-4102-a68e-dfe7f6dfa4f6", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767444, "uuid": "0590e97e-b780-4077-b36f-c95c97da3a23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767444, "uuid": "0ced76a9-ac38-4c65-be09-6602853ba2f5", "value": "88863861e03c74eb9b3015e95df10475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867434c7-fb68-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628771191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771191, "uuid": "44c1da3a-a3d3-4682-95c6-23906f580bbe", "comment": "Malware payload (njrat)", "value": "6672396fbc8d95998e078ddbc3b67085", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771191, "uuid": "5a0a1989-cd02-4639-a521-f37e71ef189d", "comment": "Malware payload (njrat)", "value": "3bf5f251905471ab07782554a58cfa444e4693c4b1ecad16471c489924fd1fe3", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771191, "uuid": "a350393c-66d4-492a-82b4-5b511cf7e9a2", "comment": "Malware payload (njrat)", "value": "4ee3d2cb05f798845fc47e2b8735380fbc09f501", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771191, "uuid": "070d9579-b995-49e6-83dd-48bfe16e225c", "comment": "Malware payload (njrat)", "value": "3663cce96f26334d8cbecca8b3d44240c18bf9b6b0d3f8b6b363e1f48495c72f22319d711200b087fa309de11d93430e", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771191, "uuid": "6a73daf4-3956-40af-8ad6-f8a4dacf07c1", "value": "T1A521F6034C98EC96164CF54122838DE4C263A7B70B8D2636187965132DAC79EBD4DF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771191, "uuid": "b04dd100-354e-4dc9-8982-3b6f9d5ca7f7", "value": "24:fPqR2zR8GvsSN/XxGTXO2UEcNbgygWVRaZ:fPaW8GPBXe7UEc+yZLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771191, "uuid": "be51a9b4-bd54-4cec-bb50-11985b6eb51c", "value": 1248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771191, "uuid": "706edce6-0237-4cd4-9136-209e23a159ba", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771191, "uuid": "decac6f7-05b1-4a70-a9a1-2e06b0649c70", "value": "FEDSD87210078.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1801cc6-fb0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733065, "uuid": "5f160bd4-0f88-45ee-afff-b61048639d22", "comment": "Malware payload (Mirai)", "value": "240bec34102f783e9346fa564e956991", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733065, "uuid": "15e7f9ed-a578-44f2-8c41-d2f3a01b5db6", "comment": "Malware payload (Mirai)", "value": "3c1cd9a2ff0ec3389d6ca5cb42115f943f182079b704a34a4d9431cc99c475f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733065, "uuid": "e75c9fda-3c4d-4395-9278-d253dbd89f84", "comment": "Malware payload (Mirai)", "value": "8d16a1c78fe1ab024e621d4523cf60972395dc19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733065, "uuid": "b854b66d-7625-4e14-a151-1a042187b940", "comment": "Malware payload (Mirai)", "value": "01c3e108f0740119e0392598af766e732506acfa8f0473b769985b9cd35849e2ee3172a4613c34a58a7bb89e84eb7608", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733065, "uuid": "6a677629-9557-440c-a408-ee7bae56c3b4", "value": "T158433AD6F400EE7DFC5BEA7B8012490AB531B26149630E77A363FC87AC720A55D36D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733065, "uuid": "eda3d973-99cb-4364-b9d6-c626d9a13e2e", "value": "1536:DNSo/D69DJ66kKETjaHNNNvYiFL8wTej8Om:CcNKESHN/gxwKJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733065, "uuid": "788c21ae-e62e-4781-b66e-9e55c161ac02", "value": 59264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733065, "uuid": "e9c870ce-a3fb-4eb5-86b6-0d937fc99789", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733065, "uuid": "78875f63-bd34-4b44-9fa1-b4d1a4e61312", "value": "240bec34102f783e9346fa564e956991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce3f058-fb79-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628778289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778289, "uuid": "6c17df7c-af54-4b73-9a39-ddac53989976", "comment": "Malware payload (Formbook)", "value": "9e59d98eed0bd959f1f5d2ba36e92859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778289, "uuid": "029261ec-6249-4d37-a8a7-fb6eaccfbe7b", "comment": "Malware payload (Formbook)", "value": "3c274255e35e340152ba94463f4b27e0f5f2554062abc27b4ec4d3389545379a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778289, "uuid": "4d3765ad-a499-4b96-82b7-9f4a31e5e8d7", "comment": "Malware payload (Formbook)", "value": "d4ebcdefbec753e3074f81f58f067e8545d5bb95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778289, "uuid": "1ba58875-ceda-48bd-b518-3752011fee7a", "comment": "Malware payload (Formbook)", "value": "158c91ca49467233be59d1cd2f75a9e16208a4c8dcba369cc3458efc2008db08ca6c8dc9decda060e6e34434a8cfc9f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778289, "uuid": "44176a27-cd53-47dd-b4a7-0969acb38dc7", "value": "T1D055E43D2AB92227C07AC775CBE18827F0449CAF3521BD99A4D637660372B5675C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778289, "uuid": "a7a1def5-bd11-484f-af51-d9375c9534a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778289, "uuid": "7939c089-71e2-4cd9-b82f-e6342bb3c49b", "value": "24576:FSkLO1suaWgV27G0ubgrdCq5/RHAZZS5R09n9Y:FSj1KrV8G7SE3B99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628778289, "uuid": "de3c808a-2139-4816-8a70-b031d2f38247", "value": 1405952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628778289, "uuid": "c536ea29-c848-454f-9e09-e112f57f4e6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778289, "uuid": "dfe4411a-7556-4f9d-bc86-c80c9583af3d", "value": "Inquiry_202108-12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbf0e6b-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767150, "uuid": "a3535654-0c78-4c3e-8f58-f7b5d83e9406", "comment": "Malware payload (Nitro)", "value": "55d3a93ab948a1bad005a276fd64ca77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767150, "uuid": "ac5f6bd7-5350-4d0f-aa06-cfe75d69d12d", "comment": "Malware payload (Nitro)", "value": "3c57851605d84398dfb0df0050ed4542a6a64a9c6008525dcaea4f35d0b5dd90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767150, "uuid": "c45a4087-674a-4518-bc73-94da51ac249a", "comment": "Malware payload (Nitro)", "value": "03e59428389de848cd34da7482363faacd9a771d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767150, "uuid": "e2f800bf-5008-42ec-8168-f3553c95a11a", "comment": "Malware payload (Nitro)", "value": "c087787cdca9875fc96026fd4096d947765868364e2dfa8d825168d31580358505e5651ea43536e8532cf6e302cba0a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767150, "uuid": "1ecf5492-6b0c-4158-9d95-80074a4155a3", "value": "T1D05365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767150, "uuid": "4066ed2a-1f1d-4b58-b07a-26b8c6b68c7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767150, "uuid": "80142ec0-0fbd-4085-9aed-3508c8b8dc0e", "value": "768:GOucKn7n1JjDNANIUxqvLDwUzc80gmq3oP/oDL:GO2jDNAPOr/0O8/oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767150, "uuid": "c04f6005-58c8-4735-b04e-c35d1afe75cb", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767150, "uuid": "3142f450-3889-4784-9e4e-0949efc1f893", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767150, "uuid": "6392fe46-f819-4ecd-a110-3ca538d27256", "value": "55d3a93ab948a1bad005a276fd64ca77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dfc3e7-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767514, "uuid": "ed72379a-c836-4812-969a-6331cb126bc7", "comment": "Malware payload (Nitro)", "value": "afaf618c64f27964d7c3c893b3fd02ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767514, "uuid": "d8197f8c-6d22-46c4-b18e-f09eca0edb35", "comment": "Malware payload (Nitro)", "value": "3d154c48a97fefce2f139c04675f7b475f30453c442941813ba9f02b159c8cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767514, "uuid": "dddb6bc0-4c96-4240-b510-d85ee264b10a", "comment": "Malware payload (Nitro)", "value": "ac8ad311f58d516d9aba9380cfff8d104ba09012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767514, "uuid": "d40a4353-9ba9-4393-a38b-fa8e132bb7d4", "comment": "Malware payload (Nitro)", "value": "6c8ac19511acf3224035f8b1c4032db3986371894b24403b3b90c95f6ca1bbfa1e6a190acdfe0b9e67e588d7fb02f0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767514, "uuid": "31afa5e0-4deb-4314-bed9-3db58dd2676f", "value": "T18A5354286273882EC56C81B811FB2F7C2BB0AF556460C7AD4A78D26C3F677B78D10B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767514, "uuid": "a7cd1092-b5ad-4dda-8f5c-7354c62389e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767514, "uuid": "2bf03f2b-7565-4799-8b9a-1d37b448926c", "value": "768:VDOucKn7n1JMDNANIU0vLDwUzc80gmq3oP/oDm:BO2MDNAPCr/0O8/oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767514, "uuid": "9497947a-4478-48a6-af39-e28fb18b9928", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767514, "uuid": "64fd9537-f047-443d-9ee0-ee7113cae5a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767514, "uuid": "1b15fc77-4e15-4a1c-b949-727d9069a73f", "value": "afaf618c64f27964d7c3c893b3fd02ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2fe98a-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767471, "uuid": "7c3aacc9-b428-4951-a25a-34c3904acd17", "comment": "Malware payload (Nitro)", "value": "a064b524a661ce56c911fb3b184c1b8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767471, "uuid": "2f637f47-a04b-4084-8514-b29b8ba1b988", "comment": "Malware payload (Nitro)", "value": "3d782b5f5304e058161dce64bf27fc5c28af23675ce6db1fc46386fb8f532c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767471, "uuid": "16f9c1f3-f3d3-4311-8b5c-4d3e1a867910", "comment": "Malware payload (Nitro)", "value": "a39aaf5834308ce443b56d80b7cf28ad9eb8f2f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767471, "uuid": "4a3685ac-5658-4eea-91a6-b507fdc7a3b3", "comment": "Malware payload (Nitro)", "value": "dcc64073781b927c6eeba32b82565dc0b76f94ce40278fcdaad4da042e1fed05a6eec37d0f838ce23a405ac0e3a7c8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767471, "uuid": "46608c3a-60a8-486e-a86b-598b908ded5d", "value": "T1665343285173862DD87C82B815FB2FBC27B0AF166460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767471, "uuid": "4a16bef5-249b-4801-8856-9ce005a5a820", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767471, "uuid": "f7c6774e-a424-4509-ae19-554b55e309ee", "value": "768:gnbyhKtnWoRxqf7GNI4r8YLDwUzc80gmq3oP/oDY:gnbRw7Gxpr/0O8/ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767471, "uuid": "4fc5c909-3e46-4c31-ae44-b8224d497377", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767471, "uuid": "0cf131ab-ef14-4920-804d-4f071a778734", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767471, "uuid": "6b3a89ed-53eb-40e9-a0f2-13bcee0216a4", "value": "a064b524a661ce56c911fb3b184c1b8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802a3146-fb67-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628770751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770751, "uuid": "4fb2888d-a364-4a6c-ae95-5fea08683582", "comment": "Malware payload (SnakeKeylogger)", "value": "0180553c8dd0975008452f800538d8f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770751, "uuid": "29cad53f-7bae-4600-b71b-bd8f94458e8e", "comment": "Malware payload (SnakeKeylogger)", "value": "3db7acda49978813a627559815f7ed9af54b7eb1a914ad41ed3bddcdc96ebbb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770751, "uuid": "1290ff31-7ce3-42d5-aab5-925e992f6082", "comment": "Malware payload (SnakeKeylogger)", "value": "1b8adfcb5619761bc44f6c17dde5477241bbf307", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770751, "uuid": "fa5d9de4-d2c2-454b-8737-bd00ed3297ab", "comment": "Malware payload (SnakeKeylogger)", "value": "547743d6800f6236983ba5287a1aaf6aea53cde9c959f3a9aa5b1312a5cb2b5ddeab7e7cabf41e455307ab7a8de95fd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770751, "uuid": "05ac5dde-9cdc-43f0-92de-ff9839a6ee0d", "value": "T1E5F4BF9D729072DFD417CA72DEA41C60EAA174BB971BC247902301ADDE0E997CF246F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770751, "uuid": "9e33f7bb-b1d8-4578-9edd-b4451d0d446b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770751, "uuid": "c87e8014-34ec-431b-92ee-8c5c9025dda6", "value": "12288:wWJ/HK7zSCPuaj5cBcn/YP6r56B71riNHFwZ3Pe6/nD0lmkFN9xsGHf/cXnatxLt:wWgOCfqBM//d6l1riNv64VNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628770751, "uuid": "dd6544b9-a787-4808-8082-8cac1ae2e27d", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628770751, "uuid": "8f17383e-278f-4a0e-8ea7-91d0bceb4bad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770751, "uuid": "61b8ce6a-ed0d-412e-929e-408c7fed06b7", "value": "0180553c8dd0975008452f800538d8f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f93fe50-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766804, "uuid": "262b6778-dfc7-410d-bd8a-fb90eccd71e2", "comment": "Malware payload (Nitro)", "value": "0a46c17b1f2bec1a3a038db008089cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766804, "uuid": "02f67650-d741-4da5-adc0-50e83f36a283", "comment": "Malware payload (Nitro)", "value": "3e278f996264ac27bb55268a51a8f7389106abf81282fb102855e41c90f3337d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766804, "uuid": "d8cc8014-b7ad-48db-bce6-1e1aa6dabc67", "comment": "Malware payload (Nitro)", "value": "375ec1d96f35207b151e70bd2bd42d21247be720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766804, "uuid": "eb0e2ecc-25b3-4ab6-bd1b-6f3d9876d37e", "comment": "Malware payload (Nitro)", "value": "0412ffd7669daf0bb996f2f9a1dbc07de964648d6af30926dcef8797ec54b89492ca62958fcffc4c69db1bee7ba6359d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766804, "uuid": "c7f54fa3-7872-4598-9a39-bd709602a617", "value": "T18453542852738A2DC47C82B815FB2F7C27B0AF565460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766804, "uuid": "fbb42038-1a60-4129-91d5-2a2075b82f01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766804, "uuid": "583908c3-5cde-42cc-9057-fcbc53a1ca69", "value": "768:9KsMqCXfVcWpjDMLoiANIUde4YLDwUzc80gmq3oP/oDtA:9KseVMLoiAPdEr/0O8/oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766804, "uuid": "1209bf5f-ad94-4aa1-8698-e4d9bc52dcfa", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766804, "uuid": "5e402b22-4b87-4fbc-a905-6cd1a901f565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766804, "uuid": "8c996faf-859f-4f86-948a-743ba32d420d", "value": "0a46c17b1f2bec1a3a038db008089cbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d37c3e1-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750103, "uuid": "39800dc8-9252-4ea7-810f-533d2824a7b8", "comment": "Malware payload", "value": "dd5273b0738f81f68df91bf0e59f3311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750103, "uuid": "b5c99b00-a487-4d3a-8d3c-bbd4ef1b93f6", "comment": "Malware payload", "value": "3e39dd8626cc0c86424a49a077a5d26a216b5d09311f363a5bee08e0aceb94df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750103, "uuid": "5ea2bd74-2e89-4677-8aa3-9a1560fc2188", "comment": "Malware payload", "value": "f2257c96da251b0bed59efa040f81391aa8a9877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750103, "uuid": "885ec625-9431-44b7-af04-86611d04d545", "comment": "Malware payload", "value": "888488b375bba38bac8825f2694fe6159007adc54300acabe8bcbcfec3e4fc9a9b1dc0f58401d080826c908930ca5ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750103, "uuid": "30661934-bc7d-42e0-bb6e-d7842b8757ed", "value": "T18D4402724588C1E5DB56E370F047F3AA82AB6E928B21095F13F23DCD247DAC64EDA057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750103, "uuid": "e89ac6f4-8379-4dd5-8caf-7ca5cd0c9190", "value": "77f81ec12eacdb769388a8e410647817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750103, "uuid": "256590ff-246e-411e-8821-0a80222fcc24", "value": "6144:r4sQhfFwNaSne7QdUjdUljrEYAFxfMGbxqvr:reTwNaSPej+QYAFZbxsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750103, "uuid": "45799de9-0462-422c-be19-6eba2c59caf3", "value": 278482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750103, "uuid": "b6f618dc-0daf-4997-88bf-e3f636ca91cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750103, "uuid": "804996d5-acf4-4273-8b13-d39092527d1b", "value": "dd5273b0738f81f68df91bf0e59f3311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8307183-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766980, "uuid": "b75e6738-7eb6-4297-9789-d5a5a8525ac4", "comment": "Malware payload (Nitro)", "value": "8c703ab22ef3986c9352cb2a83a67ee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766980, "uuid": "0767252f-b7a8-4b42-b2e1-3969d9010136", "comment": "Malware payload (Nitro)", "value": "3e54ff7bc2d77a79693cad713d568b009c15a10c1845ca837964fd29c3bfa488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766980, "uuid": "5d6384d3-6940-4f1f-843a-e9cdc63f7cc8", "comment": "Malware payload (Nitro)", "value": "aaeb995ec27dda0b8ffacdc6e04614666518a3c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766980, "uuid": "42a8dfeb-de05-458e-b5be-7b09dde773de", "comment": "Malware payload (Nitro)", "value": "fc701e4fb66fcc92cd2f0ff6b6d497c1f1919d48a80228e3a849e7fce3b576f241963a82ed1ab93ebe1c9fa4741f9a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766980, "uuid": "fbf35983-5f0c-4b56-97e9-e0b0048914da", "value": "T1E65354286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766980, "uuid": "297ced6d-fdeb-4c94-bffb-80d9a2ba328e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766980, "uuid": "5c574ae2-1fb1-4510-93b8-4a3ddd523e2b", "value": "768:POucKn7n1JKDNANIUsLvLDwUzc80gmq3oP/oDsw:PO2KDNAPgr/0O8/oww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766980, "uuid": "67cd821d-58f8-4a29-915a-2a13cc1ef167", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766980, "uuid": "fbd5bf1e-20b6-4c89-a939-4e2574a92e67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766980, "uuid": "e90f0a43-87cf-4497-a235-1bf18216b14d", "value": "8c703ab22ef3986c9352cb2a83a67ee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba429da-fb3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628751872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751872, "uuid": "eb29cfdf-ad82-4cc1-9712-636f677c97b9", "comment": "Malware payload", "value": "b2ee819b434a21012e8d7583adb2b415", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751872, "uuid": "31532e4b-ac50-42f8-86bc-4211cb2fa0ae", "comment": "Malware payload", "value": "3e5ab0b50e64201cc2f6dd7be35f3d35c0736eef0477db88a71d2ff423048241", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751872, "uuid": "8965db9e-1eda-4ebb-af93-873fc7f65d10", "comment": "Malware payload", "value": "c453db2d58dfd1a870cfe06b2eec606307ac95fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751872, "uuid": "1688e16e-d05a-41ec-87f1-26274a46216b", "comment": "Malware payload", "value": "a901530e0b75421adbafe94e6b6cc4a5bcc11798b33df9ddbab77064e24a37c2f9bf90325582a3035317d9bb5ba0df5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751872, "uuid": "bec4cde7-0036-4976-805a-02c98a47fcf7", "value": "T12EB4F132FAC185B1D57319355AF8D731593D7D606F248E5FB3EC3A2E9B300809629BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751872, "uuid": "fbea3e90-b97d-4797-aaab-ce76d9b269ea", "value": "73d12a96fab08773e2657237992c3c27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751872, "uuid": "2edae1b1-04e8-4c41-80ca-bc879a59cc3d", "value": "12288:UbQOkZWCMud0jGPd76X+t4UQsB7J1Y11Vnhv6rQNBeB31:w9kZWCMuo4d7gUxJ1oVhCrQN01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628751872, "uuid": "67468297-c868-4bdd-a201-5cb44e54cc5d", "value": 524965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628751872, "uuid": "67bf1fb5-e6be-4582-9c5b-e48b2dcacd30", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751872, "uuid": "7028c094-6d0e-4ae8-966c-fba81bf0616f", "value": "b2ee819b434a21012e8d7583adb2b415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78d48d7-fb7e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628780830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628780830, "uuid": "791aefd6-a95e-4a79-8687-fb2884879397", "comment": "Malware payload (AgentTesla)", "value": "7bcf7f5c07449878eeece3f9786b86a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628780830, "uuid": "4bf764fc-e398-41c2-99a7-0a907c7bb980", "comment": "Malware payload (AgentTesla)", "value": "3e8d88bff15e3d4d29684e9d61e19334aa4662abf38034e9573ddea639a58138", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628780830, "uuid": "8bfe0ca5-ba2d-4c90-9a0e-02642132b4e7", "comment": "Malware payload (AgentTesla)", "value": "f41a149d8126cf09a3797c697bdae2141d6f7cf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628780830, "uuid": "7952deef-ec6c-4317-9c65-16f29539ceeb", "comment": "Malware payload (AgentTesla)", "value": "12047c21e2461b092cb8e1bd1d0a2ea9150af4629e514110fdac57e0c4c5f31d6e0c0f406101780ba9eb0a67b584fc23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628780830, "uuid": "b4a43b9a-e438-41d5-979b-c4f8a7ff366f", "value": "T145154A2439EA501AF173EFB64BE4B996DA6FBB733B07A45D109103860723A41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628780830, "uuid": "db6875b8-e8f9-4f11-b124-6f88b64d61ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628780830, "uuid": "50911e8a-5c8b-4bc5-a746-a3dda3871536", "value": "12288:e59IVZ/Zz5VF7hAXX9MAPlMH+4j1YAm1q4LUz5+O3QCqox0y3Kz58HxnynjXaXL6:zzLxwwWphRP0+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628780830, "uuid": "726fa3fe-f4c3-45b3-83da-9c947941d934", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628780830, "uuid": "e007a0f1-3584-4ddb-8b06-f00aa9c785a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628780830, "uuid": "e255c81c-02de-4904-b605-accc1a377a2c", "value": "DHL Tracking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180c7d1b-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628776160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776160, "uuid": "52410f40-75ea-49be-9984-c7e2ae2c8981", "comment": "Malware payload (Dridex)", "value": "7f8c450cab9ba7acf1f081f06a7812b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776160, "uuid": "5adf98bf-63cc-435e-9b30-4f6aa10f4c89", "comment": "Malware payload (Dridex)", "value": "3ea9e629fa353c6e19b68916e613d4cc64101c4f14d011333a6814feeceab404", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776160, "uuid": "1a9571e6-516d-447d-ad41-1239eaba5feb", "comment": "Malware payload (Dridex)", "value": "aba4f04bc4185b50f5d8b904f5de7f4f8a899647", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776160, "uuid": "8245a55c-0a35-49ed-a1c0-70e34612b32f", "comment": "Malware payload (Dridex)", "value": "8121a1bcc6466ecd30867c5639796e72c0ffe4b1ddf9d7f3655fa1d67e0aab476b55d46eace2eddf18708d3af541fcf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776160, "uuid": "012c11fe-8a85-4a3d-92fc-54ee7787bc9b", "value": "T15604C090D9EBE5E9E09E5ABA5C7BF23F62685B578720CF5BD364C71CE6A2D4010E1300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776160, "uuid": "f063cedb-726a-4b05-ade7-c2a8d32d0b5e", "value": "1691313ae64e22216ac678d4d81d8bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776160, "uuid": "ad45424d-1ca7-4cc9-a783-988fb795b1a5", "value": "3072:oJQ6H3ykY88YOSs+k1TwEuTcMIznNuOzlr1Xznku9Luk0eJww8JOa//2uFrSc:lfYOX+wTScR/Xzku9LVwZuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776160, "uuid": "d9e05c5b-ef6c-412b-9b92-13cd5914da9a", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776160, "uuid": "fc166384-f316-482d-a060-1192a3e6e737", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776160, "uuid": "8c79d3e9-fec0-478f-ab32-111b253cd292", "value": "7f8c450cab9ba7acf1f081f06a7812b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17930346-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738363, "uuid": "fb0147dd-7c33-479c-9ceb-e643f881a43d", "comment": "Malware payload (Mirai)", "value": "c3fc959f029958bb24b0544d61ce34cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738363, "uuid": "6e87c1d3-3728-4527-ad18-92cd5fc0baf8", "comment": "Malware payload (Mirai)", "value": "3eaf0b0f0d81b2659f664e1e70baa7df6c4ba4e1355bdd466011cf6ce11212e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738363, "uuid": "2d0cdf80-1871-4dcb-9705-6d6215659ce1", "comment": "Malware payload (Mirai)", "value": "480a58fcd28fc23f0017c3e1baa7e23d23144c11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738363, "uuid": "c2042833-a61c-4b80-b9d8-973a55a6155c", "comment": "Malware payload (Mirai)", "value": "867485a94249c2f764a3a8d92e010b1825274f3d7af948c0d170de95cd8bb7c848b0490a51b41dc8c68adfc71ea6be6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738363, "uuid": "13c2497a-2895-430d-925a-3b8ff004bc10", "value": "T1E7E2E1BDE36A3454CF691E75604B1A784BD831C132BB8B4E5331ACC56336485BB3ADE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738363, "uuid": "2ee062b8-170e-4cbd-ab2b-abd44d7fbebb", "value": "768:eef78pr/7dItbVbi8LGNj5m74Hg2uF4B7TGecUwwvpYgWE:eS78phI/b3G1sEHYFOfGedpYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738363, "uuid": "335748a0-98de-4308-badd-9e7446d30f60", "value": 34032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738363, "uuid": "0fda4707-1b0e-49f0-8305-eda8abcfd803", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738363, "uuid": "a0c6c364-25e6-43fd-9643-5dae84f0b981", "value": "c3fc959f029958bb24b0544d61ce34cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbe68c0-fb3f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628753701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753701, "uuid": "893135e4-6f2d-42c1-a3db-df0333839f43", "comment": "Malware payload (Loki)", "value": "80ee353884779a0484a8c2f1a4d09e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753701, "uuid": "c85820a6-60e1-4990-9604-72331f4e9116", "comment": "Malware payload (Loki)", "value": "3eee35e2da8d727156e4ac74426f9ee320051fe209ddeb50c9f47119d07365d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753701, "uuid": "94e2c56b-7038-40f5-8f60-4ea94ad505e7", "comment": "Malware payload (Loki)", "value": "9f06127986e611efcf022a398a1db02497cd1f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753701, "uuid": "5c9cc148-4077-4072-82e4-8ed97d1db369", "comment": "Malware payload (Loki)", "value": "d710f1c94c360652c1de4881ccb3a09e47c96a0e8c5076f55b46de2685aed92536092fb569ab30fe6a0fb6ae6c278bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753701, "uuid": "d2cfb18f-5ee8-4e60-b087-9f6fe252c30f", "value": "T1A2E48D777A48C222F59DB4B8F1A2E5F8D8B4EC20D86D0A53BC393D2D76F9691280D147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753701, "uuid": "79540688-7011-4117-9dc1-2769cf2a4e08", "value": "dc195339b27b4fd5a57110edcd4091c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753701, "uuid": "fe52b4db-e4d5-4c58-bdd2-23733a497e95", "value": "12288:/L37lQ33skuuXuwdFPTXReg6hdfH4eiV1cQGJ53Q:eLI1hdgeiV17GXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628753701, "uuid": "35546441-ff04-4eab-9983-42bcd5613be4", "value": 664328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628753701, "uuid": "f6668ad0-d86d-4856-b03b-97b5e0063a2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753701, "uuid": "3d814af5-6e64-4fff-a016-26880914eb2a", "value": "CE.PA.-SRL inquiry_(P.O-VT246098).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75704cdb-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628776317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776317, "uuid": "e85772fb-37e1-41bd-a2ae-0c23fa92cdab", "comment": "Malware payload (DanaBot)", "value": "0b6fd9f0eda46983a5df44c086e9f073", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776317, "uuid": "8326db3b-9990-4284-8f98-623adab7def5", "comment": "Malware payload (DanaBot)", "value": "3f7ef3fcc9141ed9a7d7620c90325356956947add46038ece8167d8c5028273e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776317, "uuid": "787bb587-927d-41cd-81d9-6dd9393a5f08", "comment": "Malware payload (DanaBot)", "value": "65e9a9a2a550d30cc497686a7c17900576b0a501", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776317, "uuid": "b361240e-4153-4223-ae50-811db18f69dc", "comment": "Malware payload (DanaBot)", "value": "6314a7e75bcd299f3d17bdd7974c845afe8d611a2813a190629ca5b080e96ee0fa29eac4d358917e5734c974663ce536", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776317, "uuid": "9ba7d3a3-9f4f-4dbc-8deb-f2bfb2da936b", "value": "T194451230B791C035F8B612FC44B6D3B86A3D7A61A37051CB92EA17E95B346E49C3139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776317, "uuid": "0e961179-b844-4532-8dce-2c6d19cdfa65", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776317, "uuid": "4a25cb47-d950-46b4-8ee9-65efbe383c1c", "value": "24576:YNC4WivbbYqTkj7wtLCeEIOfN4wZvK7G2SLlZ8dwkVGDs09du:MRvbbYqYj7QCeXyKyK7G2SsuMGDlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776317, "uuid": "89f7e8d2-5016-4948-abb7-0a93772452c4", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776317, "uuid": "5887be1c-e096-4738-b433-7e402816e211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776317, "uuid": "87e90bdd-a1aa-4a84-b4a7-a180d702422f", "value": "0b6fd9f0eda46983a5df44c086e9f073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7a8854-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767010, "uuid": "5d5d3cd2-00fd-40c7-97fb-de3575b2afb3", "comment": "Malware payload (Nitro)", "value": "9eb71e5d0d58d3b454e88bf58bb8553b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767010, "uuid": "6e568d78-bcbf-4cae-b02b-4d5f56d2ec23", "comment": "Malware payload (Nitro)", "value": "3f85f13eb1e75a7ca07a06707af2a69d2d534734be2b98cd951bdbbc4b1a38c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767010, "uuid": "9752bce9-891b-41ff-ac19-91a2a70e09db", "comment": "Malware payload (Nitro)", "value": "5d4ee9daa02e0e0152a583ee9dcd488c151e4800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767010, "uuid": "5bed45ec-d6ca-4f45-9d06-a6fc86a7a772", "comment": "Malware payload (Nitro)", "value": "9b9781390b621a1c543d6ea9a5fa5adc8c07325e9abce5b35f1d6dbe786e1dccb4aefc32f382c0de0524fef8f4ef0804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767010, "uuid": "8fe933ff-86f7-4036-ad69-5ed1a77615db", "value": "T1A0B5338033DB0257D2FDDC390A7922501368CF9B9C93C68E78D61B9CD472794BA5CAA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767010, "uuid": "ed60a15e-27a4-49b9-a212-0dc5f10b91f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767010, "uuid": "9c4c78db-bd56-4205-984e-e4ef89c10c1d", "value": "49152:igVHF/hLAkvUG0M7tRUlCnlSNPMzEvmhzQ9QJmqpcg5INw/8hPBTLF3:ighLAybDRXY0zQS7crNdhPL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767010, "uuid": "d0b26762-3afe-45d7-bf75-41bb41c385cb", "value": 2283520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767010, "uuid": "b2af826f-3c75-44e7-9a27-b91c0b3d5b3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767010, "uuid": "4bc47b64-edc6-44bf-9563-11cf0b552312", "value": "9eb71e5d0d58d3b454e88bf58bb8553b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67308c29-fb75-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628776722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776722, "uuid": "847edfa6-6bf1-4f7b-9ec0-4bf872773d64", "comment": "Malware payload (ArkeiStealer)", "value": "ef0370c80915653fe001b5c9682bde37", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776722, "uuid": "3aa8f92c-4011-4efc-87a2-7d716a4354f2", "comment": "Malware payload (ArkeiStealer)", "value": "40480036363a57a125f0ba8d78005327b8e3f7d496d486961e75bf67089034bc", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776722, "uuid": "ccb0b67d-b723-498e-a1fb-df7cab77361c", "comment": "Malware payload (ArkeiStealer)", "value": "98d60720102caa4e52ba46ef79e6006484908fe4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776722, "uuid": "22b8ad2b-9892-486f-adcf-3c3c81dbf40a", "comment": "Malware payload (ArkeiStealer)", "value": "a1ea64c0ac9e38b4d34ed1e42dfa93b0d72e78d3fb5641b518a0e249541852e5a0852a5ae356e7ae1682efeb042afb0a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776722, "uuid": "3fee9b17-dab0-48ed-8960-9fbc9fa32077", "value": "T1EC55E23E6D85033BC2B8EA34C6E88926F5AE699B33132E4898D763D55F131C37C9505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776722, "uuid": "54c90015-3367-46bd-b6dd-bad1703c0364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776722, "uuid": "cd8c95f9-0093-4ee2-823b-19ee1d5cc575", "value": "24576:F1Eb+vbxtTlUfP4fzFmVzDrltuJWqqnL0FChMy14Fu/xNiXkrQV7CVhPL+MMXF3W:F1Ufr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776722, "uuid": "417694bd-87eb-410f-aaeb-8224a6e39eab", "value": 1347280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776722, "uuid": "00796b76-e173-4fc6-9cab-c69a75225b02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776722, "uuid": "66ed9088-11ce-427e-bd0c-b576258d96fa", "value": "ef0370c80915653fe001b5c9682bde37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ba8bc8-fb36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628749614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749614, "uuid": "9a066bef-ee2c-487f-8633-bcebdc825be4", "comment": "Malware payload (Formbook)", "value": "49be70c935e80f0e61debd1ca5b8f87f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749614, "uuid": "5b52033d-7696-4a4c-bd38-33651b1dd813", "comment": "Malware payload (Formbook)", "value": "40902a40b1d1abd6e6b7a2d4c463d454e92eaecb3a7518d046754ffd269f217a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749614, "uuid": "ac8c411e-511d-4fd4-aebd-3c825dc4d803", "comment": "Malware payload (Formbook)", "value": "6d6964955d1c4e620e79e48c69e292f18c2402a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749614, "uuid": "7bf1d40a-6fd9-4fa2-b660-18284cb2d550", "comment": "Malware payload (Formbook)", "value": "cf5f60258c2022a7756dd12d753caa476ac94e8283143144590c52bbb9a5ffcb90f76f10e908eee53bab4222f60a27a3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749614, "uuid": "b18a045e-59a1-4b2b-aab8-1c4022f50aaf", "value": "T12F92C0DDC5827711D6125ABCD0CC9312D9D1BE8C8747C2AF2E14F65C2A8BA031A5B25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749614, "uuid": "3d35b16c-de31-4b23-a379-e4dc32b0c75c", "value": "384:AKlM2l//oLwZ2qCEFUraHV+gziz9k+vQITMaTJqrm:AKlMa3Z2xEFRHV+gziFoIgEqrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749614, "uuid": "9aa0c889-eda9-494e-8d1c-cbd2e5c94f41", "value": 21010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749614, "uuid": "17e438e9-5818-4651-93f3-a679bf6ce998", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749614, "uuid": "f339e707-6791-4406-a67c-20a0b681ab5d", "value": "Payment receipt.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ec88db-fb1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628737666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737666, "uuid": "1456a62c-8082-4476-a145-821529de7d21", "comment": "Malware payload (Gafgyt)", "value": "38bbff7e1221b3c23eda8dd37d0d33a4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737666, "uuid": "f63ac060-a283-4d17-af09-c2b4bd5cc921", "comment": "Malware payload (Gafgyt)", "value": "41ddd3d646fa8d12b038c373fc0ba3db0ee68b63a00e602e0ab016cffce5c1a4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737666, "uuid": "f7cf92a8-3c5a-409d-8148-58e9052232d8", "comment": "Malware payload (Gafgyt)", "value": "c80d8df693316f0f4226b5642f81fe80c8774ee6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737666, "uuid": "1e8a0483-f33a-49f3-81d7-c31c8d043bbf", "comment": "Malware payload (Gafgyt)", "value": "1630860a797f99052097bca6f3ff022f5ae7201407a130857fdf490f03e90fe35a44d90d8af2fe60a17a8e5be5eec27b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737666, "uuid": "3ac6e1ba-7ca6-4f61-8632-d8671c2b5e42", "value": "T1AB836B23A651C6BBC0C75AF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737666, "uuid": "25d71edc-c505-47bc-9c66-ae767cd9f631", "value": "1536:eB7cH1LhKlBqISVhuzdPQq0aJP9sWtjG7ew3nhuWgf6UmoIYuOVje+ZNne:eRMhKlcduzdPv0o+QK7eknhunVmrYuO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737666, "uuid": "1d59e5cf-0d82-49bc-9b8f-74ed20f9a9a1", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737666, "uuid": "015a1038-5069-41b5-be64-19451f077fca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737666, "uuid": "022fc20e-18bc-400b-ac0a-e22e6365e04e", "value": "38bbff7e1221b3c23eda8dd37d0d33a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8c10ba-fb44-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628755713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755713, "uuid": "496a3a2a-69ff-4180-97be-04d1fd84e220", "comment": "Malware payload", "value": "9a16f2daee967596759d98a0ddc3d431", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755713, "uuid": "0f4a5c90-a517-454a-ad55-6618bcf688ba", "comment": "Malware payload", "value": "41fb8db09f8c23f6d429dba822da247f27b669e520c4ae7e3a80d512284e27a8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755713, "uuid": "2227fdb7-0b60-4dd8-9d6f-b69266a392fc", "comment": "Malware payload", "value": "3e2f1f75374be3fa7b0fad5f831d6088f17dd718", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755713, "uuid": "8df163b4-be91-49c3-a7df-edd142156599", "comment": "Malware payload", "value": "7a00dd8e3fb3a8f3b5ba1c515f82a4277a3ee246d6f9f04275440100e82d4cd9896434271238571df41e32cf82617312", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755713, "uuid": "1c8d8240-99e2-4234-b96d-366487423872", "value": "T1DE65F19FE8036F05D335D4AF1E8ED9243CAB01BF9E929B17746675839FC098AB02541B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755713, "uuid": "77917642-3aa2-4826-bbee-3baad7a8ad82", "value": "24576:VWlhNtEIDmMq7ghN49lcOvvLH7uxq6F5NC0GEeLWeEn3U23FFZO8R8pQz4/slp:V6pEID1n4FLaxq63cx5LWemjVFlRS0lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755713, "uuid": "bee5f3d9-7d14-4805-b11f-2ed2af0d93da", "value": 1542133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755713, "uuid": "60a94603-e9f9-4e96-ae94-2268cc9271f3", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755713, "uuid": "1a2803c4-3afb-4c91-a22d-7aa50703459d", "value": "version.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91693619-fb77-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628777652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628777652, "uuid": "43fb58b0-5a6b-4bc3-b628-b844339295a2", "comment": "Malware payload", "value": "119581ed561115fc33fc08a292fff64f", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628777652, "uuid": "376df0f2-84d3-4fee-a245-f0cde8978489", "comment": "Malware payload", "value": "421ae9597d6b602b2c82944ea41c5ed9fd72535c8b890ef1f71d2c745d751c6c", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628777652, "uuid": "2372065d-b09b-4d99-a5a0-1fef3c51cf1a", "comment": "Malware payload", "value": "274ab405fa7fc64f97a389ee5ce2c6533c0a936c", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628777652, "uuid": "bcc46555-6e59-4872-b440-df454eb6675d", "comment": "Malware payload", "value": "5fc1cec5f2bff0169e57de3b8b960bde1f1196d4de137f47fee56df8c019ffe65ab61a261cf0418e62034f0a309b4923", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628777652, "uuid": "896d64d7-9c9f-4d59-ac97-c217df9bfd6d", "value": "T18D123408A613B02F7A7112190533085CFFF1A86A75A985823F58DE877DB33661BE2F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628777652, "uuid": "fa765c1f-6790-4856-8b3d-c60d4b7a67e5", "value": "192:I3YRMfghQ/cgJ62zkU3xpGwJtCEcSk6qffK1gqWG0BJL7cKnveS/RSTrr5N/jmpi:I3YRMfgC//U2zkU3/GktCEcbrnK38JLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628777652, "uuid": "9f50dc67-25cb-4a93-a61a-db6a8388918f", "value": 9101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628777652, "uuid": "67ae430c-d942-4526-85ec-ec4ba1ddb74b", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628777652, "uuid": "2c516a49-bd8d-4c6e-aaf0-1b8a621d3400", "value": "loader.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74dab2d-fb33-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628748563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748563, "uuid": "13b6fb85-b97b-4081-86d4-89ebabc169cd", "comment": "Malware payload", "value": "06e488767f70a7ed20e0e5a291751e1d", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748563, "uuid": "c5bd179b-5800-4953-96d7-2e040eb2741d", "comment": "Malware payload", "value": "4260f85f091926c4bfeb6391a22c904be3fe2bdb178e395814038caee02ccef9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748563, "uuid": "fa75ae3b-febe-4a5d-9e32-1ad454412a6d", "comment": "Malware payload", "value": "633d37fe446b2e2ae605840c262669e685c1a6e4", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748563, "uuid": "d3159258-4ab1-41e0-812e-36487d639d0d", "comment": "Malware payload", "value": "89c014c743b72f301f29dcd8fa792db25edb88d258ad24da258254216b47f5a53d20cdf73579ea5ef091873b6a18b5c7", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748563, "uuid": "b7eba367-943b-4ac0-be74-311df4fb20c9", "value": "T17DA2A3103351C522E29A59724DD2E3DB2B38FC92ED95C70B32C4B72F6D3A594DE52386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748563, "uuid": "1de9e8e7-0588-43cd-90d5-46c4cc4f8a75", "value": "192:hAiPMsOYo/AftzxSY7WSN0TYFEX/Cehp7y1FSeFeeFJGFTFB4TMUsPe:+iLOf4GGfKTKEX/CIBy1FSeFeeF6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748563, "uuid": "6b892124-7255-4c90-9807-c0ecaeaa7402", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748563, "uuid": "80bc7b46-8060-421f-ac12-e82fccc3fe08", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748563, "uuid": "9a47b7ac-cd5c-45fa-a817-daa6915abe7f", "value": "cooo.b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c07cdd-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767645, "uuid": "03903dd1-0b2f-4be8-93f2-490986cc8b9d", "comment": "Malware payload (Nitro)", "value": "cd92652e488f7b34b06243001708634a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767645, "uuid": "c265e2b3-5d7f-4fc9-bcac-1d2342cf90c5", "comment": "Malware payload (Nitro)", "value": "42af7f7d66dfbbe25f515cdc5eeb118e30849f343c0f69b673c4aebd30f6fd56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767645, "uuid": "4e12b6ca-8633-486f-ba5a-96dfd28495f0", "comment": "Malware payload (Nitro)", "value": "fb5f3022b802b589fd406676bed5b54b9089d4e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767645, "uuid": "effa976e-157f-46bb-a0eb-b7db2dd77142", "comment": "Malware payload (Nitro)", "value": "cf682ea68bc1662c33fb8240ff5c0c5f3b01c3ba964c8a8c904068c9eb6aad98325fa6fa3648b2d3e1fa12c699d409b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767645, "uuid": "d61f722c-defb-489c-86b6-c4640ab134e5", "value": "T1155374285173992CC87C82B911EB2F7C27B0AF566860C75D4A78D2AC3F277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767645, "uuid": "bf129f44-2b28-4eca-a66f-05f1a24ccacf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767645, "uuid": "53d6da50-7f81-41ad-a046-422a1cda5580", "value": "768:OJ+uiBAYleAF7LDwUzc8Ugmq3oP/oD7buBApANI4n2yV:OJfAF7r/UO8/oX6QAx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767645, "uuid": "21fb0855-145d-4299-97c1-fb4ddd055ff7", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767645, "uuid": "3b66a2b4-9999-4ffb-862a-dbbecba5a9c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767645, "uuid": "e42b475d-8575-4aaa-9ec1-c8ed79230d84", "value": "cd92652e488f7b34b06243001708634a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b90814-fb3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628751708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751708, "uuid": "1e27a27b-d65f-4195-910b-735537005e8d", "comment": "Malware payload (Formbook)", "value": "3ddba9dd096fe52fcd90d41478bfcba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751708, "uuid": "f613f2de-4445-4b47-8ffa-bad828de928d", "comment": "Malware payload (Formbook)", "value": "435b924af18dce67e3fbc2b55fc515b839fe883da2e10fd3c8c21859a1181d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751708, "uuid": "c6a93392-c296-4626-98ed-aad6be716156", "comment": "Malware payload (Formbook)", "value": "43c708bca3d1bb944adc81b3b7a1f7b2fb80c4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751708, "uuid": "b295b7b9-00aa-497e-9b21-9431519677d8", "comment": "Malware payload (Formbook)", "value": "15ad088f2673cb2a3a650b55eb27423399806a24ebe12caddf072d33294cdca52dba77fa6a174bbabe7f189c03e89121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751708, "uuid": "60463832-d2a3-449f-bfc8-ffcb4d9d15ea", "value": "T14FE402452BE85F69F87E6BBA4B64205103FBD0475B22DD2E6DC511EA0F67F00C662B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751708, "uuid": "0088ccb1-6651-42a5-a48c-641644df4a0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751708, "uuid": "6b525bae-d46a-4e9d-8d91-bc81dd238bdb", "value": "12288:PLI/HK7zE857ioHjT4d1MIi7vKgwl6m/Zcl2APRq6to0D2TPgRqIq:zb7ioHjT44j7vPmhwn9X2T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628751708, "uuid": "de3ecbbc-2c09-4c3a-b2fd-a180578fca59", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628751708, "uuid": "f479be5a-7907-4321-ad35-4f31b13c6baa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751708, "uuid": "5877079c-bbba-42aa-b821-ad4ad214c5bf", "value": "Pending DHL Shipment Notification REF 81121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25d2e78-fb68-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628771265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771265, "uuid": "14ce8b28-b25a-4415-9948-f213e7bfc2d2", "comment": "Malware payload", "value": "e73a3faefb27fc175de1a621e4ee0fdc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771265, "uuid": "e8707beb-8f39-4d05-b763-261658c5db08", "comment": "Malware payload", "value": "43c4487cefb437e0d86cc078eaa488765c939f88a2306e2d3a0242603762cf82", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771265, "uuid": "b2b79a73-a4cc-44f3-95c5-46160d13f5cc", "comment": "Malware payload", "value": "ee42ede0af4b4dfe57b9580c45517e5184c4ae4b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771265, "uuid": "5dd41390-4499-4d4a-86f2-b65f6ddcda79", "comment": "Malware payload", "value": "2e55f632f694f41bbc8255c80ff0efe008c10f1f30caf105fcd291af2e80356e416195c756243bd64fa2a1a3612866d3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771265, "uuid": "4981d94b-e869-48f7-b89f-052f4182cb71", "value": "T18EE312EE9F58685DA1D9AD902771D700688E659FEA04EE0178FC4CDFDAF0D00AA431A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771265, "uuid": "08e0e0c9-fb21-4bdb-bd76-6c7869440ba2", "value": "3072:aZ97hhgwQsR3JXsiY/QUJkX04WSt4xB1Y48V5cwFX9Qc:IXi+l78kE4LKBUcwFXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771265, "uuid": "e26b4932-b83e-4670-a8d0-26cc6ca09376", "value": 155904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771265, "uuid": "dd70ebb6-355b-4c8e-b2ee-4d222dd928e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771265, "uuid": "c9393944-41b0-4388-9145-d1e779763271", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676af1fb-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767703, "uuid": "f0197a31-0524-4062-a2d5-893be4b05603", "comment": "Malware payload (Nitro)", "value": "e57dfe50b2843667adc026fdece135a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767703, "uuid": "9b72273b-2907-429c-94a1-51e45c7e4d1a", "comment": "Malware payload (Nitro)", "value": "43d9690031e56222c155756c23e88ef09f680d8a3b3e796058690212ce2d89b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767703, "uuid": "930fcddb-7dfb-4bf5-8cf9-5d72c07e8d9b", "comment": "Malware payload (Nitro)", "value": "30eeda6affea66773a69624c9df8cd64e143c918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767703, "uuid": "65b029bc-f1dc-49ac-afb1-29b8b3c07523", "comment": "Malware payload (Nitro)", "value": "e56d2a82e8f951b173711d0712d3d8c5d05d37c2f9cb505b1d86c478200a072cc949394e2a207c10ca0a444697875c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767703, "uuid": "dbad1a86-bdcb-4598-9d47-99786d511597", "value": "T1B253542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767703, "uuid": "bce9cbad-6a23-4371-af5c-219f110ffa85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767703, "uuid": "ed4655be-9858-4af1-a45c-5c8c8e25cab6", "value": "768:RKsMqCXfVcWfeM9ZkiANIU1NYLDwUzc80gmq3oP/oD9:RKse2M9ZkiAP0r/0O8/oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767703, "uuid": "ede836f4-78ec-4842-b438-04ef8387e2a5", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767703, "uuid": "676a3a8f-9117-451e-98c4-5ee70a888485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767703, "uuid": "c20c4241-976f-45f6-8b3a-e42d9b05ccb0", "value": "e57dfe50b2843667adc026fdece135a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88651737-fb1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737694, "uuid": "00b0b6d5-a283-4139-9882-0e0d5658ac81", "comment": "Malware payload (Mirai)", "value": "7273f978b8d0ca700e1a228c8e7f66b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737694, "uuid": "be805100-c734-43a7-b823-ebab700604ed", "comment": "Malware payload (Mirai)", "value": "447cad678f71de84a373f0c65364d4f7ee110ebd2142d3822e81699f2d020e82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737694, "uuid": "fbb3a266-cd77-46ae-9916-c1574b260272", "comment": "Malware payload (Mirai)", "value": "1bc1108ff9ee268daa5556d92277bc78f0811c6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737694, "uuid": "900b0319-a24b-438f-9761-e3b76e56bcd8", "comment": "Malware payload (Mirai)", "value": "91a3abd61e4ac841f8e523ea5d91b75b0f51a5bf1af9b71becf405142754832b1fd8fb98ac921511b5605744ea3d89d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737694, "uuid": "3496c4ce-f288-46b9-b6f9-5c1f3881bee7", "value": "T1ADC2D0307AD8B9B0C3BAA4B99B987111F30353A795E7231700506A6494AB54B37FCFD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737694, "uuid": "d2756d33-9feb-4de0-ac91-2236ce9f0855", "value": "768:hL7GgFP0x2J8ER4AIQYh8HM3Oy81eBThjs3Uoz9GH:1+x2Jz4YHM+y81elEz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737694, "uuid": "ef726adf-2e43-4c5b-9a7b-4c697080ff7e", "value": 28232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737694, "uuid": "df240b98-964c-4ced-9a95-6f2868fd9850", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737694, "uuid": "19566f20-5d46-47bb-8852-3659f0140f65", "value": "7273f978b8d0ca700e1a228c8e7f66b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70074c6-fb25-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628742577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742577, "uuid": "161ade94-07f1-4a80-ad14-dc8028058a57", "comment": "Malware payload (Gafgyt)", "value": "031045ae6b9a7a9cec650efdbbe1cd60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742577, "uuid": "1a74024f-2e8c-4cbf-a5fd-3e845fb84b3b", "comment": "Malware payload (Gafgyt)", "value": "450fe1f6791268d0d8c2192f4f8a436f2d56cfb0534c617f99e88b6bc91ebd08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742577, "uuid": "1da64b10-1789-48f9-ac69-2c935a6f5898", "comment": "Malware payload (Gafgyt)", "value": "b7ebf793eee2f16528609bab47776f03255242d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742577, "uuid": "c1cc052f-aa32-4381-8e5c-b6c8f44c41f9", "comment": "Malware payload (Gafgyt)", "value": "70e6ad212dad33769f0ea3680beead1b7a58c6fc6ae3f120327af78f3f753ee1b879d1a6eec850145901e46b19e5975a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742577, "uuid": "064e7561-31f5-4659-9989-8bdbb0335bc3", "value": "T19C63F807BB51DEB7CC5FCE7307EA4601208EE45A06A46B1F7274E96CA74B98E48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742577, "uuid": "e3bcb7d2-8393-498f-8e2a-b5a445bf0984", "value": "768:HIteT2gHwH8XemTdyfwReYK9bPZsc7XiIYKe0edHn2K+qmfIZnjVnHlmGNSL9Z:H8eTHQAHn9+Zsc7YKRuHna4nJHkGMhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628742577, "uuid": "351ef8d2-46a6-4a77-8ade-54223c956ae0", "value": 73379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628742577, "uuid": "b3ad34cf-72f9-43ad-a12d-c32e6d1859c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742577, "uuid": "ed3001d6-bc8f-40e4-ac0c-23ab8aa8514e", "value": "031045ae6b9a7a9cec650efdbbe1cd60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fd38f9-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767617, "uuid": "2b4c9157-b8f9-4b4c-a22c-acea0ee6d92d", "comment": "Malware payload (Nitro)", "value": "cba654cf359b8d6175303ac28d6c1bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767617, "uuid": "d038cd48-23fd-43a6-a89c-6b69f45d6941", "comment": "Malware payload (Nitro)", "value": "452122b0fe32b7ebf79cdc387378d6e5bdc65ef82e6b1c24f5e3a2b0e8ddfbe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767617, "uuid": "e23ed1bc-6d42-4eb7-8923-4b893ef23933", "comment": "Malware payload (Nitro)", "value": "4ee1f00227c608083bf6f3a27d08e2a80da4472e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767617, "uuid": "00f9dbbe-dc6c-4e3e-93cd-d005de395143", "comment": "Malware payload (Nitro)", "value": "c2adb9ad9df34023f6eb2dd72f7c2878d5b1c4f6d3718d47ea802c5df415d83dc81cba781c5e18afe5fce13cee8e59fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767617, "uuid": "5e3f099b-9802-4559-890c-3dccb1b0c8c4", "value": "T10B53542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767617, "uuid": "5940b2b3-9aad-4ce6-ad0d-a2f4642a5c0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767617, "uuid": "1a0ce6f0-c730-4560-9314-7ad61be153cd", "value": "768:pKsMqCXfVcWlQM9ZkiANIULSYLDwUzc80gmq3oP/oD9:pKseSM9ZkiAPLr/0O8/o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767617, "uuid": "3cff30af-1cc3-40a2-b2eb-282bd34974ca", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767617, "uuid": "e7ad8b9f-b658-4f58-90d4-4bc5e6726eed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767617, "uuid": "78ae1e5f-18ff-43c6-b7dc-56a4b09ca5dd", "value": "cba654cf359b8d6175303ac28d6c1bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7391df7-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767058, "uuid": "e99c37c9-e8b6-487e-bb95-7f6d27b8130a", "comment": "Malware payload (Nitro)", "value": "20e405b8a2a9e50b7d6b755888e1e1f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767058, "uuid": "af182c32-7ebe-4ed8-afed-5bfdd540efce", "comment": "Malware payload (Nitro)", "value": "45f7d3ddf852b2e90d66799f0f51c6ce199c18c559ab159043b588026f6667cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767058, "uuid": "dc142703-bfa9-4c7c-a0e5-5702b27e958e", "comment": "Malware payload (Nitro)", "value": "92a138705c978e5349ec2f43774bff2de38c1417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767058, "uuid": "e139fa6c-682c-48aa-b195-fba3da50ea9d", "comment": "Malware payload (Nitro)", "value": "737b05308551722c041f7d4115ea6249939d9c73d4519bdeec2b8e513c86b0b17252e3bf4e28e9a7117ef236120b0baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767058, "uuid": "cb53e42a-6c5a-4def-908b-fad74566e037", "value": "T15C5364286273882EC56C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767058, "uuid": "fa351a5e-4375-4a5b-8e38-a9371ab770eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767058, "uuid": "47563c81-2eec-4712-aff0-0420c13817ef", "value": "768:ROucKn7n1JqDDANIU8X9LDwUzc80gmq3oP/oDV:RO2qDDAPmr/0O8/oZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767058, "uuid": "a258ec94-7b0a-4a2e-974a-a71cf43ad113", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767058, "uuid": "a1aca0c7-3343-4e67-a06c-297aee87031a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767058, "uuid": "9d0f5a66-e06a-4b56-8846-3a963a585d0f", "value": "20e405b8a2a9e50b7d6b755888e1e1f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2f4247-fb64-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628769402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769402, "uuid": "447ab4be-6493-47c6-b376-3108c741f2d5", "comment": "Malware payload (Formbook)", "value": "277b8bac14e09015d53ad66c97e272a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769402, "uuid": "5494692c-c813-4db2-9a9e-a6f5717317d8", "comment": "Malware payload (Formbook)", "value": "45fad79d5665cbad096d1029eb228bdca999352958c393d08e2813787fc2dcb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769402, "uuid": "fa427ae8-2a4b-4ce9-ac9e-5264bd2596a1", "comment": "Malware payload (Formbook)", "value": "ef1bd1e7dcd9633244c3e9bcaeef190ff8eab47d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628769402, "uuid": "e9de0133-d429-4171-b4cc-f6651ac34787", "comment": "Malware payload (Formbook)", "value": "f27308888edeb1a8564b306005e43aa4c5340d3c3ff56c5a2341c0515773a62e85ca9dcc9bdcd5ece3885802b37b1a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769402, "uuid": "36c1ccc9-d00e-4ff7-a043-75b1f6934a76", "value": "T156554C3D19B92637C065C6758AE1C81BF0409CAF35D9E97E94C29F26C2D2B5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769402, "uuid": "210ffa05-b716-495b-b102-0f441b5e432c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769402, "uuid": "0e01345f-7529-494c-89b4-7b5d3da3cca0", "value": "12288:SCpc6JmEOMCQryZ/3Mc64rc2JH9EY9n7MKScl8qRi7ggQDmH7PQ6H+Uy1Susr8Mk:LJ0MCiyHfc2bEYt7x83EOMZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628769402, "uuid": "f746c17c-8315-4c2e-a245-73618bfe29ce", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628769402, "uuid": "157d7bb8-5f05-468e-9667-761e821ab87b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628769402, "uuid": "1bdd8f0b-8093-4c96-bef7-5f59bf470c7d", "value": "Remittance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44efc871-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628750465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750465, "uuid": "95940695-f24d-462e-8ff1-3cf6340c6089", "comment": "Malware payload (DanaBot)", "value": "02f6cd0c20673f819bba4b21f4d30d44", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750465, "uuid": "1aee0942-520e-47e9-8b31-bbf69b25b25f", "comment": "Malware payload (DanaBot)", "value": "463654d4c0ca86dbb8f6babe6f7614ce7475dd195bc1c6ea5b854a0ed7f6108f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750465, "uuid": "e8c20c3a-b5f7-42c2-b546-9db1389be033", "comment": "Malware payload (DanaBot)", "value": "fbc98200bb30e5fd14b547dc75311f683ae0c875", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750465, "uuid": "a589f821-c161-4f8d-ad1a-64a6403db43b", "comment": "Malware payload (DanaBot)", "value": "3013749fecb42d5bbc07f9d911f2048e8662ad29cf602f0d8054f575e57e99f33dfa90577092a12eab46b3b8dbb6d928", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750465, "uuid": "1e2d34c7-cd06-4a63-9c13-d4fac1bc5dd4", "value": "T1BF451230BB90C030F4B666F8056653BCA93C7A71977450CFA2E92BED53246E8AD31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750465, "uuid": "5a0498e6-0e23-44bb-b18e-8f87107ba0bd", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750465, "uuid": "16f9bf97-9142-4769-b088-820c6d371ce8", "value": "24576:w6TleADmI4T1kagXHq96dUEcZeN8VTbmH:LlI1kagFUEcZeOtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750465, "uuid": "3ce9bffe-13ea-47b5-9340-252a3a250665", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750465, "uuid": "b9fcc040-ab25-4adb-82be-bdebf541208f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750465, "uuid": "d642d66f-348a-4a87-a891-3ef043418c41", "value": "02f6cd0c20673f819bba4b21f4d30d44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128a1350-fb40-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628753817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753817, "uuid": "a23f526d-503f-469b-a2f6-1dc646c3ae08", "comment": "Malware payload (AsyncRAT)", "value": "6bdae200b21ded52cae27d7a223af690", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753817, "uuid": "8a96f887-471f-421d-b7d3-ab0cb6a11538", "comment": "Malware payload (AsyncRAT)", "value": "465966504b71b61efd8b63c2b473115b51666d6e5beab1aad6f5da29fa82f2c5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753817, "uuid": "d36a537d-e4b2-4939-9415-58b635e8d60c", "comment": "Malware payload (AsyncRAT)", "value": "4e0be4edcc211aa6752bf4ae343b1a5896ed4c59", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753817, "uuid": "e73f98a1-c8ed-4b8b-b34f-a484e69718ba", "comment": "Malware payload (AsyncRAT)", "value": "55770682ee13a5723f867b6393195ee2f4bd2527f49abb708d253f835e88069a410b36bb02736a7d3f0f362ca9b85177", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753817, "uuid": "dfccd941-70f1-41e4-8fdc-1e171f3606e8", "value": "T17E55A23C29BA2627D0B6D375CBE59827F4509CAF3151BD94A4CA73260372B5279C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753817, "uuid": "f2711440-d551-4700-87f3-ff45eb5d4ea5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753817, "uuid": "7692ef80-1b21-461f-b7e9-74aea0478837", "value": "12288:5zzi6I/R83Z9ZBYY8PZZ/0vEaocP2T2fXJk/HmUVpI33EVDst:5nI/R83ZfWL6vEaocP2T2fXJvOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628753817, "uuid": "3f8f19d0-1c2a-4834-913d-900a81dab189", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628753817, "uuid": "a7b6bc92-742b-4054-90aa-5941733d28e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753817, "uuid": "77b599d6-c9eb-4cd6-9c6d-e8d438da6119", "value": "Updated Quort Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd48b69-fb0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733084, "uuid": "82d6f9f2-19be-44f4-9e51-add76865703d", "comment": "Malware payload (Mirai)", "value": "ab7fa8072c9e1e3a21f0094aae25c43a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733084, "uuid": "d34bfa8c-81d9-4a47-b446-9d1476d2fafb", "comment": "Malware payload (Mirai)", "value": "46b7b3127a0d75ac66ef533fda14d96091af89cc0de8b13b30ea46e8715a8465", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733084, "uuid": "87846106-0088-4a26-87eb-feccb4d44422", "comment": "Malware payload (Mirai)", "value": "898c584cfc0553ccf0ddd93fc565f84a72e50e2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733084, "uuid": "8f5f3e7e-3832-453e-8119-54428e2e4ffa", "comment": "Malware payload (Mirai)", "value": "d761c13f5f30675adce5c34ff44c7cc9b768369ab8ab8b6ca3a066b96e739abed8251f9a7031beefe15ca8fbe7389160", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733084, "uuid": "03e64e4d-ecea-44a6-8924-7524c59c2cd5", "value": "T1C863185ABC918F01C4C4127AFA1E118D331357A8E2DEB3279E146F207BCB96B0E3B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733084, "uuid": "f9e35d74-7cf8-4c9a-bd5d-23607c16b555", "value": "1536:YInQ5liPMNbb7OoMam5Bhbi/WnIuIgygxcrIYiZd9hVens:M5lJ79MR5nkFubJd9hVen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733084, "uuid": "6fd1d49d-5a62-4351-a8ea-72a5a8b2653a", "value": 66976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733084, "uuid": "681158e9-293c-46c9-b32f-c9a9b59343cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733084, "uuid": "26880c69-17d4-492a-8fa4-00f51741815c", "value": "ab7fa8072c9e1e3a21f0094aae25c43a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f7cb80-fb6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628772985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772985, "uuid": "8a2eb81e-00ad-4978-aaf7-f34cf9e11f3a", "comment": "Malware payload (AgentTesla)", "value": "9ac604ab0f70a0d75f107b8f52d97000", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772985, "uuid": "cc6af0d5-8008-41e7-8b81-e251f14b84dd", "comment": "Malware payload (AgentTesla)", "value": "46dff1fda981f377a8ae116f14a7a4352e373787186606d2c5a91ae0c6c25609", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772985, "uuid": "db3a04fc-72f7-4e39-a783-f6ce8c471264", "comment": "Malware payload (AgentTesla)", "value": "48bfbec3b38f5070419e63efce548e7a234a3f0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772985, "uuid": "3007fb65-c82e-46b6-affb-99738e54a26a", "comment": "Malware payload (AgentTesla)", "value": "84a3a4e02550820ee42b647d37488a3d98661f68fa73332c96ab411c7bbba0b1181e23ab9982ae5cd3c0c98c28c2a03f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772985, "uuid": "d950a46a-d262-4d2a-88bd-e6f7e575db1c", "value": "T10865B23C19B92627C1B9D775CBE5D837B4009CAF3111BDA4A4CA3B661376A6335C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772985, "uuid": "01ca084b-c1e6-43b1-ba3a-1306f0366a03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772985, "uuid": "b35b97bf-e3d9-45c8-a6ac-55176e914b41", "value": "24576:V/CqsL1yQdGc9O42AT2fXB52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMX:icAGc9O42AT2/KMMMMMMMMMMMuMMMMML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628772985, "uuid": "6dbd802d-7bd0-4cce-a44f-a35110debea9", "value": 1429504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628772985, "uuid": "9c8ae343-b28a-4d34-b7ed-17d46fed2c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772985, "uuid": "ea651e60-d0f6-4d48-929e-eaa401055b70", "value": "BROTHER INDUSTRIES - INQUIRY LIST..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479bb979-fb4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628759489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759489, "uuid": "6bd8b41a-ed3a-4d60-af71-d9dc155e02db", "comment": "Malware payload (Loki)", "value": "2185f799306271f52a13cfe6391ead41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759489, "uuid": "368cfef3-3789-47cb-9e98-c04ac6a8be25", "comment": "Malware payload (Loki)", "value": "47046d5dfe7ecf45e4c31f25b975af78684f9727b91a7d052b5731e95d2f0a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759489, "uuid": "b13081b1-0406-499e-8d9f-a7396327ea5f", "comment": "Malware payload (Loki)", "value": "f0f925827d87f175ea20836e3f1e45a9e9a2a913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759489, "uuid": "36b12cd2-2adb-4cbc-8d10-f0ee39b059cb", "comment": "Malware payload (Loki)", "value": "a73ef099b04b267ef0eeba6f76a487f24bee9eab0d2bcb14a916a893d0702e6ed31ae8fe372257524ea5b58ed0881a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759489, "uuid": "362ed187-da5b-42fa-9bf3-a7421cb33206", "value": "T182E39D3337C0852AE286EB7050F112A95F14FC5F884A2A071B56EB5E54F8D33F1EA75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759489, "uuid": "f984f76d-7ce2-45ff-995b-af191c527a2e", "value": "59e6745bf35b42f470b21adfbf2b29c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759489, "uuid": "f085b696-cb16-433b-8488-9211bb66ccee", "value": "3072:2xEJpxEqxE2wzjo4i4EH5e2nnMCaKACgQrw9xEAxEKxEJ:UEJ7EAE2HAEZfnnUA6EmEgEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628759489, "uuid": "f3a8a91c-5b2c-49fe-90c8-db8e40992c73", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628759489, "uuid": "aa5d330c-e5e0-44f3-93c0-9e5b97f58df0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759489, "uuid": "54219a25-2bb5-4e66-bc85-a9ca9bd8cc55", "value": "REQUEST FOR QUOTE 12-08-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5f8c85-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766854, "uuid": "bb9bee9d-7432-407e-bd98-1b6316d34461", "comment": "Malware payload (Nitro)", "value": "2f63f116b7426f091b3c01c91bdad172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766854, "uuid": "2b00a671-4684-45a7-a4df-7e69b96339cf", "comment": "Malware payload (Nitro)", "value": "4789824e9884ad52ef78bf790de8d00bc848dd7de34db66916e92a87260c974b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766854, "uuid": "8203dafa-d1af-4220-8f44-26eea114a167", "comment": "Malware payload (Nitro)", "value": "ae48843324717083bd986bd325f3d1f154260276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766854, "uuid": "5c0bbe45-5a4b-48c8-b3dc-4db7417de88d", "comment": "Malware payload (Nitro)", "value": "d5e3ea4de4496bde17956f4a2015122414797278159776d2380d3609265f98d33e32f9c734db494db1099a596eed12a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766854, "uuid": "3378adbe-caa3-4232-9a46-051b8595cf41", "value": "T174D47B566BFD0E06E81C46BD49CAB791C3D039482B7333EABB4B347B49429386C7A5D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766854, "uuid": "6733f5f3-0285-49be-8edc-d859e7acb9db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766854, "uuid": "55f12dcb-d21e-4261-859f-302e26cf10ca", "value": "6144:WxQDNWoYGzih3CSKa3uHAvnJjbkPrrIJh23slsDzbQsUyd9CvstFkHUJK9eQ0eTQ:WqDkeWCS33uMJjwrr1CvAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766854, "uuid": "af71a7a1-5e6e-4f62-a816-59f6ebc8f5eb", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766854, "uuid": "1685588c-c1c1-47e6-945f-4fc59d330638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766854, "uuid": "891925da-6b1f-4d64-9b93-591b42aad39c", "value": "2f63f116b7426f091b3c01c91bdad172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9b0339-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628749106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749106, "uuid": "bffd74fd-93b2-4b50-be02-9fdc8ae49ef8", "comment": "Malware payload (Formbook)", "value": "cec7af780a758175b0de32c03e8b1cb3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749106, "uuid": "dbea39da-7cd4-4e19-96c2-afa82168c656", "comment": "Malware payload (Formbook)", "value": "47dcc6f46fb3f06b01f4adfcc0416945da3dd63764bc3fe315fc553947f18e13", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749106, "uuid": "6980edfa-af08-4f11-adb7-00be7e13e7a9", "comment": "Malware payload (Formbook)", "value": "bc4ad52ad616100718b81bb0bb4628d676b7ef2c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749106, "uuid": "97bf1ffe-908c-4558-882f-1271aee1e9ad", "comment": "Malware payload (Formbook)", "value": "462e5fe81f027708013fe76d91932b302887c26ddd057c67a12a9b989446aea13f4710b827e70ade3333dccafb59fa74", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749106, "uuid": "3c27f105-6d75-485f-8d7a-e1038bd30889", "value": "T15C04C4ACC09342A58F4AB7B89B1BAF55114CBA6DF7989672723C633417D2C3A505383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749106, "uuid": "3fc24dd7-5bde-4872-b063-daa200c5fb47", "value": "384:rseexanW/m+s7XzYXoQIoHDN/opTFCfNFy+19F3Z3j99Jb9r9GREjp4g5:4exWO+s7XzYZ/N/J/LJb9EREj2g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749106, "uuid": "eed4ed7d-46ef-4c61-ad5c-dc6a9cb8e82f", "value": 187905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749106, "uuid": "e71df902-7acb-4b61-a974-24eada830cb2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749106, "uuid": "d5234182-07ae-44f9-8266-ddc749a87f2c", "value": "AL-KONDA-PROFILE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c52610-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738659, "uuid": "ec36969f-57a0-4833-823a-a25cfea58228", "comment": "Malware payload (Mirai)", "value": "889c5da14457840866e104007ab92511", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738659, "uuid": "b1b9af4f-405e-4261-a3a3-50415752f397", "comment": "Malware payload (Mirai)", "value": "48887af057d5d35f216e7084cdcb8de6089e13a38a979e2c86dfa2761799a447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738659, "uuid": "22292505-4252-4db6-87fb-fb0a70e377ec", "comment": "Malware payload (Mirai)", "value": "b2fa282be17cd0cfd3db7af8f8b18f028c83fded", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738659, "uuid": "6a056f54-a498-43cb-b580-b8bded869ace", "comment": "Malware payload (Mirai)", "value": "54d37817d160fdf2f888a3ea24a5af655b37969eaf19e34f9a1be42ecddc0efb581cbe0613df7a34b3c867d64967161a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738659, "uuid": "e7919d79-237e-460a-b5c0-05c3e505b520", "value": "T1ECE3756E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738659, "uuid": "0c12361e-f2ee-4abb-9cc2-f090fc053a3b", "value": "3072:MzBM1x2GPyaT/75hKGE6aWURxuZq+1uPNd5R:ENOR75hKGLURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738659, "uuid": "f920e96f-a437-421f-a076-2cae2ca8b268", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738659, "uuid": "bf085ad0-500b-4459-bec0-5f5e0fc0da64", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738659, "uuid": "c86aef8a-ce9e-4528-9115-fe2edbb9b839", "value": "889c5da14457840866e104007ab92511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec30780e-fb07-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628729701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628729701, "uuid": "c91b0eec-1dd4-447e-8d4a-88b58cc8bc70", "comment": "Malware payload (SnakeKeylogger)", "value": "682a2b5504360f84d19cbd0ac2d8f311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628729701, "uuid": "4e4dfab7-96e9-4156-8650-07056ee0ec05", "comment": "Malware payload (SnakeKeylogger)", "value": "48ca2d86d3f94d2ec77c7bde9744f9c967186e7d6d61d7b72ff8e03858dfa838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628729701, "uuid": "bba18739-ec94-4486-bf62-0412f6cad18b", "comment": "Malware payload (SnakeKeylogger)", "value": "209fce1244a1a352a30217bad21b8176e66f8883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628729701, "uuid": "224f1526-476c-4401-b7b0-1c2c87efb4d4", "comment": "Malware payload (SnakeKeylogger)", "value": "92e5ca0ac38c5db5d3117389caa2e818a1fb25303368da7fc7094c7fff09df0bd8643901e02fa9af66f244a6f7338723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628729701, "uuid": "9142c664-0437-4402-b9fe-030b9d598728", "value": "T10BC44A2439FA501AF173EFAA8BE475D6DA6FB7733B03A4591091038A0723A41DED153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628729701, "uuid": "644a7010-45f9-4201-b0d0-f0c77a5f7bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628729701, "uuid": "befa4ed4-0ba0-46cf-9483-df7e3a9e4ae6", "value": "12288:80OepCqtlvWG8jluK8KfvlkLP96BWTv4CQ2aTEuqG8RPuP1k/bgtkX2avUEkrUDi:MCKUIv2bZbDVCu+T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628729701, "uuid": "37f5662c-d501-4d28-8d6a-129728937c76", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628729701, "uuid": "10af8fdd-1551-4370-8337-85288342dec9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628729701, "uuid": "04f36774-f3b1-48fc-afdf-18600f599e2b", "value": "PAYMENT SLIP-PDF-SCAN-COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efb5313-fb26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628742885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742885, "uuid": "b93c8167-0323-4107-8b5a-25e7d6c7b03f", "comment": "Malware payload (Gafgyt)", "value": "77440d390b7a8c01c42d4e457143c1c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742885, "uuid": "05f48206-2d26-43c5-8201-b18a4440276d", "comment": "Malware payload (Gafgyt)", "value": "4933b3d8e041e3c6a38cd4bf9336c9f984a3f7bbb15f4e07a1acbfef1eed21c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742885, "uuid": "80a29e9b-947e-46cf-96d4-d6550eb6f603", "comment": "Malware payload (Gafgyt)", "value": "f3adfcca2b34f6c10c115092c0a5ed7b7862e262", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742885, "uuid": "c81332ac-2926-4f99-9b8f-920f002b8c9f", "comment": "Malware payload (Gafgyt)", "value": "40f51eb4e03c0d3ee6a9cfee3f0d09acd11bd621d4ff59f43a89c20568d3a103f2490d2f026a601e6069bad46b451f16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742885, "uuid": "1332b3dc-d9a0-4bdc-9db6-aa9d0be6c76d", "value": "T1BC431892B801EFB7F40EE77644D34725B270FA664A63163173177D6AAA362C4382BF05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742885, "uuid": "a410d221-a760-4770-9dd4-cbffc2f8d1bf", "value": "768:JbM70ogb5AWLYgam8h7/kbXyQ0zoBoThscMomyOTAHoIn8V78RbayU6:JUw5AhY89KXyQooBoTicMomyOcIMQQS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628742885, "uuid": "32a48eee-7fea-4432-a5d1-c40bde1ec870", "value": 58885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628742885, "uuid": "c4edad37-3c1d-4263-9005-90edb98fc912", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742885, "uuid": "192505fc-9ada-47a5-9f25-62b4dffddfcc", "value": "77440d390b7a8c01c42d4e457143c1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a67ba6-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738011, "uuid": "12859874-4075-44ff-bab7-e33189464c11", "comment": "Malware payload (Mirai)", "value": "128a241d940917090b3fbd9a56341ad8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738011, "uuid": "6b61c327-2bbb-4046-9a1f-bd023de64f50", "comment": "Malware payload (Mirai)", "value": "4ac48aae6b65b6b6d8bad9d99e10b254d0848ef09eb0fa3807fc6a46a727d328", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738011, "uuid": "534663c1-c592-4145-b4cb-b5c08b423780", "comment": "Malware payload (Mirai)", "value": "265370703be261330182f5bc428167fea71644c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738011, "uuid": "d1e6703c-8cb2-4aae-85f6-d06612ab66fb", "comment": "Malware payload (Mirai)", "value": "13e0e8017d3cb7fd1e32ef3431754cc9a77d507b8e60bd4ee38a452dc2a7bc4e6d29e4a2230f6fe50e5774b27cfbc78e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738011, "uuid": "e78c852a-4cd6-4e16-a08a-9e8a5cc8a7a9", "value": "T1C4E2F12CA8500C59F52DD4F3663403E01EA89F6161831D6CF8A9EBEB1F552E4AE876C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738011, "uuid": "8495e33e-db4e-43d4-8f43-cc3b60989d21", "value": "768:mXYSyYdklmrEdQ5PFeMzKUZygW3PbJtlLAhRmxaSoJgGlzDpbuR1JB:+KmrEmPFeMzKzN3lJoVJun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738011, "uuid": "ab43cb64-a1c9-48df-a222-dc7a2f1fbd8f", "value": 32764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738011, "uuid": "17616db5-eb97-4675-970b-243ca49a3813", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738011, "uuid": "3ac09b23-206f-469f-be22-84ddf73a27fb", "value": "128a241d940917090b3fbd9a56341ad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa42975f-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628755360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755360, "uuid": "ea6262da-96f7-47dd-83a7-bfc3a4e11e0f", "comment": "Malware payload (Formbook)", "value": "fc2310dcaf93e7b285f5ce26db6f774f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755360, "uuid": "342a73e3-83e8-4717-bb77-d6a67345ac33", "comment": "Malware payload (Formbook)", "value": "4b1dcf9d1e2518e912abcee672aadcaed51f1aa435e3dc1b3fb43d047ec24f1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755360, "uuid": "b19de633-65a4-4f79-b97f-c14fb9ed3939", "comment": "Malware payload (Formbook)", "value": "07f489074f56e64a791e75dd7905b41f2a000153", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755360, "uuid": "ea6f76f6-6dc4-42e1-b9be-6896b543fea2", "comment": "Malware payload (Formbook)", "value": "2e30220ac8cb3ee828e085f86dd3eeb1e269703e216f3c25ef9a446d461b667f4cb2d690a3ba5646ef9219136b66a239", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755360, "uuid": "2e90a177-6b6a-45cc-ab1f-13342f814e5f", "value": "T10E75E63C29B9266FC076C675CBE59827F4009CAF3252AD55A4C73366433AA5379C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755360, "uuid": "46e73aec-35e4-4d8d-9bbf-5706d7e03539", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755360, "uuid": "e1c48219-3a10-4206-9b2c-855fceaad0ea", "value": "12288:egcKmNgis3mLyCMfv9VPtes6y/Q68trI+ePV3tebVpqU5RaT2fX/AZrSmXKz0tYw:iKhis3mgfv9VtPojINV9JgaT2fXjvOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755360, "uuid": "e0631aa3-6615-4d24-bce8-8183887b593f", "value": 1574400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755360, "uuid": "30597fc7-3810-4e08-af83-1cd20ed1185d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755360, "uuid": "9286c63d-42fd-4d82-b36f-1467ce1effb7", "value": "fc2310dcaf93e7b285f5ce26db6f774f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243769f5-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767161, "uuid": "d4187d8d-6b22-4ab1-8f9f-deccbc318bee", "comment": "Malware payload (Nitro)", "value": "60a032fe8fd5a04cfafab8a8fa869a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767161, "uuid": "d92c9cb9-dda9-4efe-8c54-c9be77ba66ad", "comment": "Malware payload (Nitro)", "value": "4ba38b73e35c692b444708f34b41b6261644c3d6851a310918f0045878d795ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767161, "uuid": "f8efe8cb-7212-413c-82a4-9b2b47215783", "comment": "Malware payload (Nitro)", "value": "4436375a70a009db43a83d3391bdd7cee0c687e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767161, "uuid": "3c11c710-9786-4b4d-bd3f-0109c15969fb", "comment": "Malware payload (Nitro)", "value": "4345abdc58fc34f1b23a06d38b37459d4229bb54b93f2e397a1b3bb7fbc362199e178b2e2f571755840a08f3b28296f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767161, "uuid": "f62dda3c-16a1-4c4c-90eb-169a2ee8de1a", "value": "T1515365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767161, "uuid": "8909206a-e789-41e8-8a05-d488f5596dc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767161, "uuid": "b87d7442-7d50-4c62-8470-9880475a5065", "value": "768:/OucKn7n1JpDLANIULK9LDwUzc80gmq3oP/oDo:/O2pDLAPIr/0O8/oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767161, "uuid": "82b0eebf-f5b6-4fdf-88ba-4a09b132aca1", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767161, "uuid": "5d92b17e-cf79-490b-8258-66866f4ab0bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767161, "uuid": "9b6e9637-67c0-4b92-babf-6cfe2e3d5668", "value": "60a032fe8fd5a04cfafab8a8fa869a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88533975-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767329, "uuid": "de55ec6d-31e0-4926-8c26-c2386a833dc5", "comment": "Malware payload (Nitro)", "value": "19497dd9999b066f248f537d6a7283da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767329, "uuid": "d957f0fc-9d91-48a8-8297-766d7dd75c21", "comment": "Malware payload (Nitro)", "value": "4cf485536039cf63c69f5de2367fbf981e66fd90e5242cb04ca92168cf2bda49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767329, "uuid": "5f43989e-f3ea-475e-a36d-63acbf3b41ec", "comment": "Malware payload (Nitro)", "value": "bb5ca105a9be57f9011f7a5fbee7d95a86725c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767329, "uuid": "7f3ceb80-bfa7-4567-a436-5f846a3842f8", "comment": "Malware payload (Nitro)", "value": "f3f92b770dcc5b5d471879b62cf4c7071b154a3a33a9833888f25e69485691f28b0c55b65f76c217a85497dd1f638e36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767329, "uuid": "4060abda-0776-4bbf-9d44-de4132167bdd", "value": "T15453542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767329, "uuid": "8e98e9f3-02ef-4c97-8c4e-adc620d5350f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767329, "uuid": "5b612fbd-e370-4512-99f9-18c31cd965d8", "value": "768:HKsMqCXfVcWpjDMLoiANIUubYLDwUzc80gmq3oP/oDk:HKseVMLoiAPxr/0O8/oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767329, "uuid": "670fa86d-10bc-4e48-aee5-d905b8feed98", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767329, "uuid": "a1822267-2eca-4e47-9c89-a6e2c48b5b03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767329, "uuid": "44822f57-74c8-4271-8e48-b9b068f7598d", "value": "19497dd9999b066f248f537d6a7283da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaba32f0-fb36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628749777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749777, "uuid": "236e3b9b-3929-44c8-b2b0-4d789028d8ec", "comment": "Malware payload (Formbook)", "value": "7a4ee3c9e3e9105814a2c02a6e326055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749777, "uuid": "cfb2b46b-824c-4eac-bac5-a5318e2b445c", "comment": "Malware payload (Formbook)", "value": "4d7e4cedde9a2c613ef907b1fd8c9790e349ae738350d90cfb6c129ef689c159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749777, "uuid": "f1aaec24-d7d4-498e-acb8-96e2c28556d7", "comment": "Malware payload (Formbook)", "value": "dc62122e0ace285034495d9be8185636de5540bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749777, "uuid": "a96e8109-cb84-48a3-b547-998fc40fc8f7", "comment": "Malware payload (Formbook)", "value": "3cccfb8bf9635279197e05be3edfaefc1c6afffdbab29c42a91deff3f16a7580b611c4dd13e16008ce7187b65c15350d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749777, "uuid": "18a6ec3d-fef3-4724-bd2f-1d6fd8a86c3f", "value": "T10065C43C29B9262BD076D779CBE19827B4109CAF3561BD54A4D633260373B52B9C322F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749777, "uuid": "ffbaa58b-b1aa-4def-b9f5-24ccdccd4052", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749777, "uuid": "3a2c2a2f-a19e-44c6-8519-228635a6b4dd", "value": "24576:zT9tUc2l1qQJqxauG32hdZ4W+fJkOV3ksFVT2fXz:dtr01dsxahGhUfJr3ksFVT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749777, "uuid": "10f3f609-06d3-4b47-8195-c676faae07b4", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749777, "uuid": "6b0a1158-8b32-435b-9beb-80bb99b335dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749777, "uuid": "1aa3a1f8-baa4-43ce-bcfd-e1471fdd3b1a", "value": "Balance payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd052cc-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767576, "uuid": "13d30eaa-1644-4314-86d1-30bd0012692f", "comment": "Malware payload (Nitro)", "value": "c786ee2a6e2f96b2a1d8f0740713d98c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767576, "uuid": "3f1d5e31-98ea-418d-8fbf-0925cb2e7afa", "comment": "Malware payload (Nitro)", "value": "4de54e96f42cfc8d0a732992a9c5eba8396bb6b0f6481b2fe289b796011e3673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767576, "uuid": "2ed8bfb1-8cbf-408b-97a6-62749576f326", "comment": "Malware payload (Nitro)", "value": "51f43a52202a02920e8b856fb3717fb787841c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767576, "uuid": "552616f0-0ad9-4e58-901a-57324d481d26", "comment": "Malware payload (Nitro)", "value": "2066e7829282f82181dc32ba4290bc61acb7a787858f032d66dad4ba966a39652557c2c124362337954329d853ed25e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767576, "uuid": "e95dcfc8-f08f-4a15-b60d-69a90468cf40", "value": "T17C53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767576, "uuid": "053815f0-17b8-4604-9ad7-cc82c5e0e36a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767576, "uuid": "bd270365-a4aa-4f72-9d37-cb3af6ea5f72", "value": "768:zKsMqCXfVcWO/M9ZkiANIU3LYLDwUzc80gmq3oP/oDf:zKseiM9ZkiAPUr/0O8/oL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767576, "uuid": "4d2dbdc3-0393-431a-a38f-60c10fa0377b", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767576, "uuid": "19476acb-fd42-46db-a892-a2f3e305301c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767576, "uuid": "9b79368c-f2a0-480f-a589-6a9c6333df69", "value": "c786ee2a6e2f96b2a1d8f0740713d98c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fd0be6-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628776234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776234, "uuid": "b3004c63-562c-449b-82be-e7b7b4ca530f", "comment": "Malware payload", "value": "3cc43fb57b3e8298b4933a8342767bea", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776234, "uuid": "6a270ab2-8db1-4021-ad3e-7e7a042e7aa7", "comment": "Malware payload", "value": "4e85467ed6be570d28ece3838e94d122fda5c1cb15463574fb870d11116080cc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776234, "uuid": "9c7bcc37-46b7-46a0-ace7-e2f5f7506b99", "comment": "Malware payload", "value": "3c80677dc406583fe2cfb0d2a09227f164150561", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776234, "uuid": "bd48c95a-d031-4f5a-b296-a163c720e26e", "comment": "Malware payload", "value": "d75627a58f412b56b0d4338cf342ff97514bb68e2e01e3cc0e9869b3cf2adab4fd45fd71a809f9dc6c33542eb31529df", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776234, "uuid": "f89fe4a3-516d-4d93-b456-94d04f128316", "value": "T14C5512D738A0030AE25C5E7D42A7F9E09319DC986A79EF1F361DB26648F9D3405F212E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776234, "uuid": "88cd8dd7-1199-4b8c-b75c-d78e49384730", "value": "24576:7kvVqUCkuP28gK5iZyRYif6EBDHkIq8MmA+ZinaTEoXZF205ga1D4UakgrLdgrh:Md8gUGFiiEBYIqFJ+xIYE05pDwLdyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776234, "uuid": "a17334eb-2491-47bc-b648-e8a052ac52cb", "value": 1301480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776234, "uuid": "0daee478-c8f0-4364-b79f-7662102893b7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776234, "uuid": "cdab2bfd-4fb6-47a8-b713-9c070f9a673f", "value": "confirmation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1306c29d-fb49-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628757683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757683, "uuid": "d3347651-3c83-4085-8b9f-4d61ef3aba8d", "comment": "Malware payload (RaccoonStealer)", "value": "9fbb5f256ee3e9238d42185ed2b48ab4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757683, "uuid": "5fe4bfcd-10d0-4060-86ed-91ef5fc74e77", "comment": "Malware payload (RaccoonStealer)", "value": "50b9bd3aea9355d60bb03f5d0cbcf3f601f1ec3d1b3c6e160bd0984d62baf15a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757683, "uuid": "84c172ba-fc42-44b0-b569-d9bdeb5e0bf7", "comment": "Malware payload (RaccoonStealer)", "value": "42430d56d85764ede3aaba70bb5ca7f6722f443c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757683, "uuid": "ba3aa881-90d8-4165-9c51-6169df1051da", "comment": "Malware payload (RaccoonStealer)", "value": "a17050f6fbde3c72922014614a93f00c56fee72ad133493b531c4d211203e9041dc12bd275eeaeb8a92e5fcca68f6a33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757683, "uuid": "46dd8204-4f0a-46e6-a653-cb910fdd8639", "value": "T157C4D131BA90C034E4F612FC55BA93BCA52C7A60973450CFA2D42AEE57356F8AC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757683, "uuid": "0b2db75b-8af4-4eb0-9d10-bd5d40b69c88", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757683, "uuid": "6349b016-acbf-4a86-9063-54252afec0df", "value": "12288:oQqeXeSlK8QuVbDc79jhITJbcUEdjuXu0dN7792ty:TRuSlMrATJgUL/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757683, "uuid": "a5d7fb03-ca1e-44e7-8e76-f4a3ea4a062f", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757683, "uuid": "c0bb7ffa-9c07-4303-90dc-d8c04bc809bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757683, "uuid": "2428bcc4-5708-483e-90ac-58074959937b", "value": "9fbb5f256ee3e9238d42185ed2b48ab4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577d9541-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628776266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776266, "uuid": "4205cef8-b4e2-4c08-8e4d-f10add06ee89", "comment": "Malware payload", "value": "f2537624ae3cb2ba786ebdf3028fc4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776266, "uuid": "b87d0a55-a895-404f-a7cc-f215e1c6975b", "comment": "Malware payload", "value": "50f02c9841c7e3215d91c1ec926ebc3863d76a664899e742b0a4a7a74cc4368e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776266, "uuid": "f626ccde-edf1-4df5-a679-4f9fd60d02ce", "comment": "Malware payload", "value": "82b97f0692798361ff57b24c1b89e0afd8f3cded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776266, "uuid": "de08ef7a-e8f0-4fbc-94b4-f0d0c5cc9358", "comment": "Malware payload", "value": "41abfd092060c1a4678a3ad1c2134700988cbf83f1f9297cc7fdb914bb1a83451541c2e41adc4b121d58ad65ac2f15a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776266, "uuid": "5bcca30c-55d6-4855-a36c-28006b59a6e2", "value": "T142B4CF31AB92C035F5F711F845BAA37CA62C7EA0973450CF92E426ED16342F5AC316A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776266, "uuid": "3c3dd0b7-e349-4351-a1c8-309aa083f58f", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776266, "uuid": "78f4a7aa-4f3f-4f92-942c-6682b9c91a7a", "value": "12288:XWwOlnX3azDsim9VLcN8RivRMikBBd5vsFCaZ1OOy:X1OBnazz38RivmikBBMAa+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776266, "uuid": "fa585ac4-7afa-4a1b-b9ba-3b73237e1ba1", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776266, "uuid": "f1c30ca0-1688-40f4-8f89-4b48e80edafa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776266, "uuid": "5a420d08-f6bf-413e-97af-09b814571f39", "value": "f2537624ae3cb2ba786ebdf3028fc4e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea91528-fb36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628749864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749864, "uuid": "45beb89b-2a26-479d-9356-56b5e21b5b5f", "comment": "Malware payload (AZORult)", "value": "db3cb1ca9eaff73d31715d03c0bffba2", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749864, "uuid": "03844b02-289d-4af2-a92e-a60dbec9223f", "comment": "Malware payload (AZORult)", "value": "51576193c87090f830b90827e9266565e9b7dd293d4818ea92e9538d68386e2b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749864, "uuid": "f46e0154-4cc9-4ad9-afb2-f2eb4bb3a528", "comment": "Malware payload (AZORult)", "value": "71fdbeb59f7d04e777723a72814ee1d3a2f4d1c8", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749864, "uuid": "c945c03f-b261-40f7-b136-6b5733356ffa", "comment": "Malware payload (AZORult)", "value": "b1a5821b9d2ee0328ef227aac7642bcdbc7bdad6e53ebc6b05a713533919c48cd6dd42ffbb74c96b49fd6fd79c8953e4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749864, "uuid": "f92436ab-1c3c-45eb-9b53-993845a3b1df", "value": "T16E649D30BA90C035F5B602F845BA93BCA52C7EA1973450CF92E42AFE57346E5AC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749864, "uuid": "2a5786a0-504e-4b5a-8074-232749e7a148", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749864, "uuid": "8e47c7d0-551c-4087-9e8f-fdeab3277e3f", "value": "6144:TA5wtxEvZVIyXasfKolvHdLYHrjWcm8PxS1V9Hsa7p5w:YwtaX1aqZldLYHmcPc9p7py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749864, "uuid": "cb4f8095-57c0-414f-a591-5f3c7c73fdc7", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749864, "uuid": "73c7348b-5eee-4595-a9f3-db9ea9cfee16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749864, "uuid": "6ccc49d2-bb39-4270-bf75-1d2257d31c6b", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a42bb7-fb19-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737370, "uuid": "577b870f-d954-4c6b-99f4-f1b2cc04a8b4", "comment": "Malware payload (Mirai)", "value": "d7483df7589e2aa87526db7741d26d38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737370, "uuid": "4e05c629-fc02-4a23-85e1-3e5bdac6c86c", "comment": "Malware payload (Mirai)", "value": "520be7694ab01493935ba96efe456a5ec249cf1717a75e0e5c215ffebfc0b9c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737370, "uuid": "eabf21b9-e7ab-4de2-b35f-e31c17936ddc", "comment": "Malware payload (Mirai)", "value": "ce7a45306fc5e2af46e6d6df4e3dc04f6b584c27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737370, "uuid": "b30d2762-4468-4a9b-83a7-6ddbd1ee5004", "comment": "Malware payload (Mirai)", "value": "24a20a2297dcdf1f68d43b7b77524afd7e379f79396e1c73b9e51510e72b1a9c60591e7f555ec26061020a756043013e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737370, "uuid": "28fd8813-c08f-401b-b520-da0c3ea9e2b9", "value": "T190C31A05FD404B27C7E227BAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737370, "uuid": "078ae3a5-72b2-4f3d-8f76-9ffe0070fb7a", "value": "3072:SJDZ+6lJQTnoo3DKOzmGfcX5l5hLuhu+6+1AzfqojwQQRh6RYAvZR:RmGa5l5hLuhucojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737370, "uuid": "069fa24c-ba39-4261-a016-866d93403928", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737370, "uuid": "4b8c3b4f-6a42-46be-aaf1-123ebb7359c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737370, "uuid": "4be51f41-be0e-44bc-9e3f-b808bdb35a2c", "value": "d7483df7589e2aa87526db7741d26d38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e526e14b-fb33-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628748587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748587, "uuid": "907a57b9-5c09-4824-9083-6eb8f046ed9f", "comment": "Malware payload (SnakeKeylogger)", "value": "9c032d7fbfdfe2064f850a9f2f0cfcaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748587, "uuid": "e47095db-c321-4bd3-9eb8-1bb6ac91a980", "comment": "Malware payload (SnakeKeylogger)", "value": "522ef9da580292e5ef0de44c4c3522f8f4fea1f4248467ff66a7d638be7a305c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748587, "uuid": "da58fd80-fc91-4af5-a4b1-1a2472e8e137", "comment": "Malware payload (SnakeKeylogger)", "value": "81633e6bb46148fff7f81330c5ca43b055f17be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748587, "uuid": "7004956a-637b-42a3-83f6-54d10abbf67b", "comment": "Malware payload (SnakeKeylogger)", "value": "36193a8924a63d996b1d2d5dce7000ebb67ddc4c12481e689b91e3740837e7fe9742c17077c678ac56667bdfdf1f1711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748587, "uuid": "eae52158-ae56-4d47-8ee0-29bc6a967317", "value": "T14E55B33C29B92627D07AD375CBE59827F4449CAF3161BD94A4CA73660372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748587, "uuid": "41211428-dc7c-4014-8840-86af41eafb16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748587, "uuid": "0f4f0907-0ce5-4a36-8379-8d3e52dcf78e", "value": "12288:MC3hpINYoA3P1/GyjcOgHf4uvP9H539XKfalV7T2fXOk/HmUVppUuEVCHo:MCTIN7EZVjcZHf4YbN6UV7T2fXOvOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748587, "uuid": "385ff169-cf09-4270-9be3-08f59b8118f9", "value": 1366016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748587, "uuid": "770895a5-e092-4a5e-a068-517cc554485c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748587, "uuid": "c8ebf66e-cce8-4163-8749-443e4d483cf5", "value": "BE-IZ-Q-1278-21 - COMMERCIAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9bdab7-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738342, "uuid": "58b4a0e4-e8ff-4da6-a8a6-ba129d868083", "comment": "Malware payload (Mirai)", "value": "2fd336559f16dc5c0bab7ec09d2a72a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738342, "uuid": "66e5c876-bbb5-4465-8b3f-91e0133014c1", "comment": "Malware payload (Mirai)", "value": "532e132422898e9e84c297746e3213c92266a85c34641347262205cc96d4a01c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738342, "uuid": "cf92e434-8d82-40b7-b560-f35828588b4a", "comment": "Malware payload (Mirai)", "value": "95bf63d160fe96c298593cf036a24a3b7f76cd8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738342, "uuid": "0d55e555-11f9-46a3-8197-907c33d85373", "comment": "Malware payload (Mirai)", "value": "9789517f0e921c88513d6961237677ee9aef4aa6f9b7d4a1dde874000d80768761ec4072d13899935e77817512970c09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738342, "uuid": "19783ec5-bd5b-40e1-bac6-fc70744b991b", "value": "T1ACD2E1F4D5200A57EBBBCF71ECC0929177E01F0A7B6642A251A79A214B1725B312CDDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738342, "uuid": "1082affa-55dc-424e-8aab-44e54f012bd3", "value": "768:mbA9JpZrXVBnr8kw94UIwotDwW/ijyCSU4uVcqgw09z:sA9bZrlBr8kw944ZVjyXU4u+qgw09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738342, "uuid": "498b3314-0638-475b-8936-271c8d9375f0", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738342, "uuid": "8136609e-07b1-4d30-8ec5-51adabd4b0a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738342, "uuid": "67e4df6d-912f-429e-9ae8-8fc791982c43", "value": "2fd336559f16dc5c0bab7ec09d2a72a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c309fd8-fb55-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628762933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762933, "uuid": "d25a53cd-6954-494e-9462-d94e7bf55c6f", "comment": "Malware payload (AgentTesla)", "value": "7e002c21588dc40e63fd6ca854bb2ab7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762933, "uuid": "58fb71ea-7c3f-4900-9994-337e6f37de77", "comment": "Malware payload (AgentTesla)", "value": "53ec270c6cef24f224cc4a2b9d42334c9ba83010f596fcf1f69156715318eb4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762933, "uuid": "26ce9d02-9d7e-4de9-8b0b-e615ce84ab5a", "comment": "Malware payload (AgentTesla)", "value": "65a86f568114b716826edef88081035adc282320", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762933, "uuid": "f9298f16-3c7a-4488-88a9-7702202b5bda", "comment": "Malware payload (AgentTesla)", "value": "278d38a79e3de42f4cdca3f1b42e1be0815faf3bcf906c17be64df034a4def1ea9c867c0d0b3ca72337b7104db470220", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762933, "uuid": "03f7c88e-be22-4647-a167-481911e55163", "value": "T11655C43D59B82637CC79C775CAE18813F040B8AF35B1AD6C94C65B668393A5335C32AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762933, "uuid": "4c542ca8-478c-4e63-9a19-ae711acc7ae4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762933, "uuid": "05ce6f4f-2961-4db2-9cf5-9b13ad03b108", "value": "12288:DanggOA4nywGaKx+3POskGvZfLAQet0YcY9/WKm52Q6H+Uy1Susr8MmH3j:OgVFnnGn7spxRet0X+OKm7ZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628762933, "uuid": "0b3782ae-5f18-4d64-9371-7aa2bd653a18", "value": 1324032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628762933, "uuid": "a1b815f3-c086-445c-a117-5bc9bb640700", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762933, "uuid": "8cc716ae-05d8-4360-a274-afd50456ed13", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.15646.14822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2c886e-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628756657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756657, "uuid": "3db427d5-c4d3-444c-8422-d27d52425884", "comment": "Malware payload (AgentTesla)", "value": "707b963e10f7e29a3f8f6f82d459c67e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756657, "uuid": "b8d52239-7034-42cf-8a1f-1ab1cabfbe34", "comment": "Malware payload (AgentTesla)", "value": "5453e8b7a17e5237cd5ee7496965fa9ec8c44cc651077521b602fb6e07c92fd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756657, "uuid": "67c57a31-e2a2-438a-b2f9-e7f9ed0e5049", "comment": "Malware payload (AgentTesla)", "value": "2f768057059623399190d518f1fda68068c51ca6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756657, "uuid": "d3cd7b24-663d-4ccd-a18e-48a45baff292", "comment": "Malware payload (AgentTesla)", "value": "abe452eaaa3ff768dbb70dc95d5ed4f493f8024ff9f0ae8f62a686e4ae1341e5bdc02b95bfacd3cd531069b58fe2694a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756657, "uuid": "5898ff60-2fab-45df-a436-3fa24809fb93", "value": "T16A64F266B6C296F0E4B129300468DCB64F2BED314A2BC4B77748173A1F701D1AA75F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756657, "uuid": "6d5eda2e-87ef-4115-8fa1-0ff0761c6241", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756657, "uuid": "7bb00feb-c8ee-4409-9464-869ff94a14e1", "value": "6144:D2hfRiOni3y30k7kQY3eCoMxc558EiiflZLlNkr3825GC+:yhfRQ3eJ57iqZLfkr3n5Gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756657, "uuid": "2a59d252-17f3-400a-a1b2-6d7dd4af09cf", "value": 306618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756657, "uuid": "d91ce2fe-34db-4036-98e5-59dd87b3685f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756657, "uuid": "a9d91aa7-e4d4-4b31-a25a-60fe6a3f6117", "value": "707b963e10f7e29a3f8f6f82d459c67e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bce4e56-fbbe-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628807976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628807976, "uuid": "9dea7e24-a9a0-452b-89dd-bae0c97df007", "comment": "Malware payload", "value": "68b689165dec5d21b039d8eff9677eeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628807976, "uuid": "a4249e55-bcab-4d0c-ae65-52d56c66bf17", "comment": "Malware payload", "value": "54619b816d64d1a770ef510c94d06d4cee747ca885188c80f71fd69434d057c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628807976, "uuid": "6b4cce5c-606f-4474-8122-473f70a12b26", "comment": "Malware payload", "value": "46e1206c430ac1fc2def69bf62240f14b8e98d45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628807976, "uuid": "452ddf16-9285-4deb-9e8e-507a9bd5c66a", "comment": "Malware payload", "value": "8ae06bb24ec1c35987b071c548bad15f509b74f0215cb73bfc45225d89cc756685825a22e7d93a5207642d0d8696bcb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628807976, "uuid": "b94a20b1-7bf3-45a5-ad1c-e0cb87a31bbd", "value": "T144E4E131BAA0C031F1B702FC45BA837DA92E7E61577490CB92D51BEE1A247E4AD316C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628807976, "uuid": "e9c1bc46-3c66-42aa-adab-9ec680bae622", "value": "c4bbba65aaf569dae0a87d41cd5cbbf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628807976, "uuid": "20bf31e5-8a55-44bf-a6bd-3d6830650329", "value": "12288:sptF7XrynBvWEwfMnRQi0DDyDB2uAo/nT390oFjtr3ZgwLKi0b:IjrynFGi0DwHAiFjtrl2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628807976, "uuid": "bc6ab37a-ac43-4190-ab05-93be9c8b4bb8", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628807976, "uuid": "28939d7d-312c-4695-8a95-2ef3c13d32fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628807976, "uuid": "ea897e8b-5daa-4895-87a9-ad2c4b4e80fa", "value": "68b689165dec5d21b039d8eff9677eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78623520-fb54-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628762578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762578, "uuid": "94bfd778-608b-45d7-82e9-83766c511f85", "comment": "Malware payload (AgentTesla)", "value": "ceda7ff3c7fee177cb9949841bbc99a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762578, "uuid": "e3932d94-ace2-4d4e-bf62-e45aedbbe8b1", "comment": "Malware payload (AgentTesla)", "value": "54920b6428a47f26167fa633550d0dffb12ec4981ede7f4e7ec9ad08948432f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762578, "uuid": "19bad041-794f-47fe-8334-168e8a25f9b6", "comment": "Malware payload (AgentTesla)", "value": "b19c733b5baffc4076266a8b6b326b5c90c64f99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762578, "uuid": "6f71912f-94f2-41fa-902e-b9bd5a2fefdf", "comment": "Malware payload (AgentTesla)", "value": "f6f0178ffb5a968d6b06ebad57c0c51ba6a5e4e7677ab387a2d54307d5efd918359fed11b484317f33a94e3f2792788c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762578, "uuid": "fe2ff8e3-124b-4f45-8102-6f346c6672e0", "value": "T14705BF783118866BE97AC531A80E4331F3A85EDAF0CDC627F4D3765A94F3221178A75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762578, "uuid": "a103da6c-b0cc-4f04-8cf0-3f05b0722fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762578, "uuid": "db09bd80-6fb4-4737-8196-d241a6c48dad", "value": "12288:8mIPtYaertAiDhIn+IiEhykGz3+eviLkGb55xGCzD:4MrtFDhInbiEcPR32P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628762578, "uuid": "ec1ba2b4-fdce-4947-b51b-cd4aec7eda77", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628762578, "uuid": "dd43f7fd-73d8-4274-b5f4-b1613feef861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762578, "uuid": "62747e36-43e9-4f80-9211-9c539461cfce", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5775e819-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750496, "uuid": "0f74c52b-6f45-4725-8f8b-06adfcd7ae9d", "comment": "Malware payload", "value": "ab94b3d4c4960558efd04d38fd42d77a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750496, "uuid": "54acb18f-174c-47f8-8e1d-065fffe1234d", "comment": "Malware payload", "value": "5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750496, "uuid": "a8d65f15-4e36-4a47-a59d-06d812e5a814", "comment": "Malware payload", "value": "2c19fdc307c1464da5709936bf397b362944a281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750496, "uuid": "477f65e8-a75f-47fc-8073-e12b88c7f153", "comment": "Malware payload", "value": "fcf1b60c150b74d449df993955e4aad7a87d43df6c2aa302d5f27b547066cf3cc1cd69137f70bda171f03f5331eb4557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750496, "uuid": "81e83563-f8dc-4d47-9db6-f11bc8428fbe", "value": "T1B094F121BD7CE872D5C6407144B6C7B4D62FB9607A6211AB3768375FEE30392233A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750496, "uuid": "cb04cc67-c18e-4991-8c99-a0e72bd47bd9", "value": "5ba12e6852ba82499f5822056a147515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750496, "uuid": "b491ccc2-8c95-481c-b581-3fdeeef6fd6b", "value": "6144:Ewc7tETNaagoFClZa34KOOh5X5jKpZjLg40QBSCPaS7knGyHM:EwEETN/ZClZa/h5X5jKpq40Q0CLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750496, "uuid": "d4d57ff6-ea06-42ad-a749-f5cdaa78ca86", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750496, "uuid": "761c34c4-1687-4f18-b113-14b74aee2fd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750496, "uuid": "3f305302-e991-43b6-ae0a-b38d043f439b", "value": "ab94b3d4c4960558efd04d38fd42d77a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6430edf7-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767698, "uuid": "fc079366-bbaf-4087-9efd-953ced371f47", "comment": "Malware payload (Nitro)", "value": "e52f6985588dcf37d05e048a45ea19c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767698, "uuid": "4d93eb35-d3ac-4225-94ba-debf38c8a469", "comment": "Malware payload (Nitro)", "value": "55eea810979f5dc33f1507e5e544eec144dd11b73773d515a8ba22ae46ba4af2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767698, "uuid": "44b3fcec-23dc-4eb1-88f5-01070f9f45aa", "comment": "Malware payload (Nitro)", "value": "c4eae2eb74150016b2825465cc2476b3f6bfdfc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767698, "uuid": "3f462da5-1ce2-43ef-988b-9e71046e1d44", "comment": "Malware payload (Nitro)", "value": "0321dd31d39d209119a216b5e29fda985ade853c0d0de8a4161aa1d9f4e7c1f07992b0148a7fa1e50c9844d85b4ae6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767698, "uuid": "87df344a-d7ba-44cc-a113-e2d90b22bc63", "value": "T12753542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767698, "uuid": "8fc3aa5c-cc4e-4c43-bd26-a0bccc87f158", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767698, "uuid": "b419887b-c2e7-4921-b8b6-2def7d472f85", "value": "768:WKsMqCXfVcWlQM9ZkiANIULTYLDwUzc80gmq3oP/oDi:WKseSM9ZkiAPQr/0O8/oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767698, "uuid": "6eb3724e-df2c-4599-a18b-d9f890150332", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767698, "uuid": "38067737-a08c-41e9-b352-d02ea9d21e31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767698, "uuid": "2cee6712-84de-47d6-a677-6cdb01cd56cb", "value": "e52f6985588dcf37d05e048a45ea19c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ba75c8-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738335, "uuid": "78ae5b9c-08e4-4dcf-a4e8-5c1625d043f9", "comment": "Malware payload (Mirai)", "value": "f1c6a173b426026befbd58d433df242e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738335, "uuid": "85fe3df5-07cc-433d-9e54-15925797cf0f", "comment": "Malware payload (Mirai)", "value": "5607ac7e4c01139c97001b1fe91f1b1eb96e935b6d1b8124ece6014356664c8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738335, "uuid": "685dd560-5632-4262-8ed8-716b69464c1f", "comment": "Malware payload (Mirai)", "value": "34fbc00761ec64defbf94da6ddd794111feae0b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738335, "uuid": "81cb6f71-b37e-4a79-b794-7aec44148941", "comment": "Malware payload (Mirai)", "value": "5b77e485ff8214a1372531beb1b3b7f1607aabdf005052a1011b59ac1909cb2024ed543a6665ae13c1da4e6a0caf2070", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738335, "uuid": "33d65b9c-b8f0-484b-8e2a-3f901022db0e", "value": "T1D17319DAA0014E6CFC9BE9FD92214F09F920221145930B16B3A7FED77F721A98D53D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738335, "uuid": "bafbe29d-a976-4e8b-a6b4-83b80adae9b0", "value": "1536:kPv+ugXKa3nn4p64uBRPTfzs7ok8g1pwH0ncHov68jJdMXrv8b:kwn4LuB7kxpDaktM7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738335, "uuid": "e7873e30-3118-4061-8298-5518015b6f95", "value": 76700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738335, "uuid": "a43d9f1f-1c55-4bee-a6d0-b8e0b7fdd010", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738335, "uuid": "8b5d9c83-ac74-4707-b544-ac6a2679031c", "value": "f1c6a173b426026befbd58d433df242e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8122eefb-fb57-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628763881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763881, "uuid": "3c6d8d23-9e5a-437b-a9ff-8329a65fef05", "comment": "Malware payload (AgentTesla)", "value": "a92d944fda1f617f62fa3e7b9b2a00ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763881, "uuid": "f342a861-ee9b-4b8b-a62c-c2eeaccedad7", "comment": "Malware payload (AgentTesla)", "value": "561728b72bcf19e6e442ddaabfd834cc05a7d7609e2739a90b71e0913ff077f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763881, "uuid": "5f0db5f7-b27c-481b-8c50-8642afa55ed6", "comment": "Malware payload (AgentTesla)", "value": "33f950e298400ff3543388b044a35b7eae6ecd95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763881, "uuid": "a6add9cd-7082-4c23-b705-5f8e90c3c555", "comment": "Malware payload (AgentTesla)", "value": "b796fc40175f68c7ef4cee9deb611a88195d396e49447cad03d02d29c9782a4afd7b7fb42d39048b5779cc51e01c8b85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763881, "uuid": "919304e2-3000-4710-9196-e5ec2318b928", "value": "T1A855C43C29BA2627D076D775CBE59827F4509CAF3161BD94A4CA73260372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763881, "uuid": "68ca72c3-7f1f-4e99-92e5-e6b0a0ecf9f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763881, "uuid": "ff015285-de8f-41f9-a3cb-51867d974593", "value": "24576:AjpKYGWKfFuBR5EGqiApZLGsaJaLhT2fXXvOO:aifFwYLL3GOhT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628763881, "uuid": "3f8b49e7-d701-48b3-8e72-e3351527e7ca", "value": 1400832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628763881, "uuid": "fc47fb28-5486-41e2-9502-e0b83d0094f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763881, "uuid": "709f96b9-95e6-415a-9040-8ac1e09ed3cc", "value": "DOCUMENTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40294861-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628776227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776227, "uuid": "8662402b-506c-4069-899f-7abd1bc7c61a", "comment": "Malware payload (RedLineStealer)", "value": "72b765579f21b2411f0d32b53fed6404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776227, "uuid": "a61f08ee-a0e4-4fbc-a76d-b17547963be9", "comment": "Malware payload (RedLineStealer)", "value": "5633314db4cd680796bc5071bd9a8d0ded1c43e4d4178c431fe5882646816b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776227, "uuid": "1a7233fa-8540-4cab-aa86-ada4718175e6", "comment": "Malware payload (RedLineStealer)", "value": "e0a24a795e502e16b2fedc178a22a9c41e6edbe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776227, "uuid": "997dc18a-b8d8-4a36-8b0e-d02c03f2a88e", "comment": "Malware payload (RedLineStealer)", "value": "f852172e6d0eabcc20d7764c96e9f1ebb12cba45ba9b6177af682fba465161ede116a5bf1c7e4b0edc3f3341c3c206ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776227, "uuid": "57df9789-dac0-4faa-bbc6-77a005a809a5", "value": "T13805C0423285DC9AE4172EF2186FD46011B9BD8F8625CA0E3F837E3B55E77022467B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776227, "uuid": "50cfeac5-c012-42e6-959b-30a18570f4d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776227, "uuid": "91d5f543-c56a-498c-b216-f22c67e157f7", "value": "12288:fD7/HK7zFspQf6KsarTy6z62XNHTndlOUB/oofw5pEVi6pjSiyyjK:ixspqsCTyf2dHTnbvhoo4d4jd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776227, "uuid": "f7431462-dca2-4532-b1d0-1013c6329160", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776227, "uuid": "1e0cd6d0-099e-41c3-89f3-45f1dd4aca6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776227, "uuid": "48519de9-3480-429a-9c6a-672bce42b734", "value": "DOCU_SIGN09986902077540087PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0693bfb-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766967, "uuid": "e26de32f-0584-48c3-9646-23b16f3d83dd", "comment": "Malware payload (Nitro)", "value": "7d7fd9b5700e82db3f4bc42e23b80f0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766967, "uuid": "fb7fe416-9508-4e53-8ff1-24be2fa8b525", "comment": "Malware payload (Nitro)", "value": "56627c61e7ce4f8073326fa9de1b2a249edfa0da9b59133224b2b9a7805b59f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766967, "uuid": "a34fc9c9-1847-4f02-8e2d-e79b818e14c8", "comment": "Malware payload (Nitro)", "value": "e090ab8505838465a552b7589c73e769fb1cb744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766967, "uuid": "fba75633-7704-4f6a-a3a5-35039d3454dd", "comment": "Malware payload (Nitro)", "value": "82102cdbcdc092968112b68302f7acb37fd3cf559188c1ba892f17dc8589e39d77eefb37987c819b6c89ab01ec468d12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766967, "uuid": "abe3f39d-cdb4-4eec-963e-f6bca9addbd1", "value": "T11853532852738A2DC47D82B915FB2FBC17B0AF566450C76E4A78E29C3E237B78C10756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766967, "uuid": "21fc0033-0f22-4715-8a32-151b52352e4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766967, "uuid": "c6503f91-9778-4fbb-8392-83bce610b130", "value": "768:3aMDPz4DezoQJCcvdY5CG3IEHXY8LDwUzc80gmq3oP/oDK:3aMDPmQYcVtGZDr/0O8/om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766967, "uuid": "9fcabab2-cd84-452d-a153-63a7a0383395", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766967, "uuid": "3f094e27-c69a-444f-acb2-61abbd466678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766967, "uuid": "12887fbf-beea-4464-a0df-5b78ac0e617b", "value": "7d7fd9b5700e82db3f4bc42e23b80f0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74121c45-fb1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628737659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737659, "uuid": "3281bea2-d5f3-4692-ba8a-25d12c0d5c43", "comment": "Malware payload (Gafgyt)", "value": "5bcf36d37c8813ec550efbbc65f8af92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737659, "uuid": "ef867040-e8c5-4bfe-bff5-b2a7d5aeed4a", "comment": "Malware payload (Gafgyt)", "value": "5698e3f453db9fbf40820870bab76d87493748b566a53bb9894db250e2076d86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737659, "uuid": "8130ba35-2dcd-4179-ac55-3ebed0ce9cca", "comment": "Malware payload (Gafgyt)", "value": "d60554ec2e7df4b07a99a370ab7a47064ef5f319", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737659, "uuid": "d89538cf-f141-47d8-bf9a-e3b15d6ae4bf", "comment": "Malware payload (Gafgyt)", "value": "c4d1e92a1f486a40da1be0ed2c71b54f621aded39de5cfb9adc2c437b1cb1751e6a6b05a9c95a50328f61823ecb9c62c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737659, "uuid": "3f60ea68-48f4-4187-849d-0dc426427d74", "value": "T1E5832A43B72D0B43C49B6AF12DF72BF187A9F96117A76180A10EBFC44772AB02512F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737659, "uuid": "73b66f70-e295-4c3c-aa1d-fa0dc22ee728", "value": "1536:tQe/XQMozMT/aj5ecEo39igRNaMo3y6VZCEmQ9VqXjtWf2Xe:tNZrSUcEo3ttKyyCEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737659, "uuid": "31103c06-b5df-497e-a761-308ec274a91b", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737659, "uuid": "bfe93aa2-8ef7-4a3b-8585-22b2f8ce3f3d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737659, "uuid": "ccdabb96-204d-4ee1-9124-efdb0fe2fe93", "value": "5bcf36d37c8813ec550efbbc65f8af92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2715022-fb19-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737388, "uuid": "3bc982c8-ff40-40be-800e-ba5773b1c64a", "comment": "Malware payload (Mirai)", "value": "3e7e3a37c8b103fdc5408dc60994557d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737388, "uuid": "fb7e5170-60a3-4d79-9111-617f56499245", "comment": "Malware payload (Mirai)", "value": "5706918d6d614e86a2bbf2417d5cb7eca5c0b0c765bcb10704e1ceb9109eb7ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737388, "uuid": "5313580f-b5a5-4e20-9a57-6d0edb3ed4bb", "comment": "Malware payload (Mirai)", "value": "bba143fa4bfdd200e1f77f348c694804c085ddb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737388, "uuid": "4ad471be-c583-497a-a9a9-2a9b221a9168", "comment": "Malware payload (Mirai)", "value": "7495d7545acae21b93c7464aaa466772008e48e8263cb566bae806023bb9c7e107f618d997a48d10fc1f36cd96f4d091", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737388, "uuid": "c1f608db-284d-444d-b360-d4965e1d01f4", "value": "T16CC32A97F800DE66F40AEA3605D70B25B630FB710E531A72A35739A69E362E47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737388, "uuid": "7825f361-2b29-45a2-a7b9-7c0dc117e968", "value": "3072:Cc9QXFndlLyqiMwtAR+dICycKcJ3QPs28rmvI0PDGnSQNER:Cc9cXpyqiMwxyc5J3OQrmvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737388, "uuid": "2be78d93-536c-41ff-8762-104e20fa4321", "value": 118302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737388, "uuid": "a4090d55-30b4-4fcc-826e-034ea16ae094", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737388, "uuid": "b2ead2e5-fa9d-421d-bf7c-62117a826cf6", "value": "3e7e3a37c8b103fdc5408dc60994557d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371346f0-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767192, "uuid": "030fb616-d753-472d-b297-b14e0518c3f9", "comment": "Malware payload (Nitro)", "value": "73de3eeba18475c6860e39061b0174e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767192, "uuid": "94864f3c-b32c-42a5-bb0e-faecb41494cd", "comment": "Malware payload (Nitro)", "value": "570cc4b6530b319dfc71201010b2775acb89c94e7d42acdbc53f635f2ca4ee4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767192, "uuid": "19d9fa49-685c-48cd-95c7-1b3704638759", "comment": "Malware payload (Nitro)", "value": "10a3823601b1a18edc62a5bbc83cd7c581f1da59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767192, "uuid": "b14ca389-5544-4266-bf3d-c87b31019b03", "comment": "Malware payload (Nitro)", "value": "ae1ef2c42b86be3f7ec22d782ef73e8224eeaf7a92dfa31bf36bb776036a277b49eee5c32a1239b06112b8016b69e4e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767192, "uuid": "64b6d8bc-75f3-46e5-ae57-2145a793171d", "value": "T16C53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767192, "uuid": "205c762a-fbf5-4acf-a301-78a4dfa2049e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767192, "uuid": "22bad4c9-394a-4bd4-84f4-f7d9bbe0e270", "value": "768:bKsMqCXfVcWl3M9Zk4ANIUI2+QLDwUzc80gmq3oP/oDA:bKsexM9Zk4APxDr/0O8/oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767192, "uuid": "7f7824dc-f37d-4892-8fbb-024907c77399", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767192, "uuid": "d121d951-8a2e-42b1-a313-778134666d91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767192, "uuid": "f7a3de7d-4eaf-4390-9a82-8a48f7600580", "value": "73de3eeba18475c6860e39061b0174e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9c4201-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767064, "uuid": "32343a97-bc72-4bd3-9867-5acbe62dfdf7", "comment": "Malware payload (Nitro)", "value": "21b111a98beb3fade37bdff4abd0e8ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767064, "uuid": "2b72a21f-07cc-4919-b1df-dfa3e63d9786", "comment": "Malware payload (Nitro)", "value": "5728cda6365347f792106d8826d9ebdfaf9d8cc40cec5cf0ef21e6584e81d5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767064, "uuid": "ca448e8c-3c3a-4d05-a286-398ec6869255", "comment": "Malware payload (Nitro)", "value": "b74d2e4477efc84bf239a1a780fb59f10ac7f371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767064, "uuid": "1b887512-71e0-4a7e-86a3-9d75e64da3b8", "comment": "Malware payload (Nitro)", "value": "0bf6f2b54b31a0bfd3685b7415dc9159704493e468946e0f10ea350d973b94e87630e613695675889e90499f67527bc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767064, "uuid": "ee543044-439f-4a86-b70a-6c9abe110b8c", "value": "T17553542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767064, "uuid": "09b53c96-ef02-4444-9900-d1e31c7c0f63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767064, "uuid": "093c1e13-4635-4d9e-b999-886eccc94074", "value": "768:vKsMqCXfVcWO/M9ZkiANIUUDYLDwUzc80gmq3oP/oDy:vKseiM9ZkiAPzr/0O8/oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767064, "uuid": "0f29fff3-bfcd-4b97-adf9-1d3ac4219f9e", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767064, "uuid": "22da3e9a-bedb-4272-93ac-69b3a87a70d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767064, "uuid": "46002b6a-e2b5-4cff-9a5a-99954f0eadfc", "value": "21b111a98beb3fade37bdff4abd0e8ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a775374-fb94-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628789908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789908, "uuid": "809a2c81-bbc5-4665-a143-f1f429e69d63", "comment": "Malware payload", "value": "4482fe1d52d8730f2ca53cf325837384", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789908, "uuid": "398d76ad-fdff-46df-90f7-183fa7e41acf", "comment": "Malware payload", "value": "57f2064661f84f9edcac16cb0d6eb690f2efa54a0ee31d9c68b9fdd0c8ecf04e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789908, "uuid": "94acd7a0-014e-484c-a761-64cd14ef1f0b", "comment": "Malware payload", "value": "6186990834f9427ad17a82e9f0b9f01851937deb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789908, "uuid": "027f8683-cc4f-4fdf-ab99-5fce3a93d159", "comment": "Malware payload", "value": "538dea34ed34550d3d00135977bb27dac20d7a2a648b7b47cdb02238a4a27e320b9881c6674f25c44b433763cc729ed5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789908, "uuid": "b66d5d34-c207-46e7-8dcd-c34476b5e95a", "value": "T19EB4FDE477C2E59366CD5E53FF49BAF9D06AB96368C4B20781947A4D20B8127C8E0DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789908, "uuid": "8b931442-7085-4e1e-b845-2d7d03e41ff9", "value": "12288:WCytsC6MUJii+uaTbi5jfZlyfBvHoCDHIOrYxSle3qGq5ii8xpQo/H3Uwllllb8j:nJNEwpaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628789908, "uuid": "40ba1ff0-7cc7-4bd5-a17a-2d41cbcbfe9c", "value": 542893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628789908, "uuid": "d55a9929-c0e6-4958-9a8d-ad1673a38c26", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789908, "uuid": "ae1a6ef5-14b1-490b-8fad-d18fb3c40f1d", "value": "57f2064661f84f9edcac16cb0d6eb690f2efa54a0ee31d9c68b9fdd0c8ecf04e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dec11f3-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628750454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750454, "uuid": "c0a09378-74f7-4e8f-b4b2-0d272e7aef99", "comment": "Malware payload (Loki)", "value": "b34575c36f5e24cd748b8cac361f7009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750454, "uuid": "77105201-cf6c-4dac-9724-45a7237fea78", "comment": "Malware payload (Loki)", "value": "58570a2d86cdc9193c235b2685e9dca6b6e3dd2215b0c66e3ea1bcbeca36c298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750454, "uuid": "20138489-35cc-400c-ad7d-efed42ab12e9", "comment": "Malware payload (Loki)", "value": "6a6c94a5ce7f0ace6e10a1f591a94bbdfdbfbe5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750454, "uuid": "b2dcfe80-33e7-4258-99cd-4d4a257872c1", "comment": "Malware payload (Loki)", "value": "2bf426bd558cc879ab7b1fe4236defb5c32cb6461351f78670589228566166274b82ebba2df535499bf8c744d3032e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750454, "uuid": "7a044a2a-c58c-47fc-aef3-f2d40f08d01f", "value": "T139F4BEAD769072DFC867DA72CEA41C60EA61B4BB431BC247901701ADDE0E947CF206F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750454, "uuid": "447ac72d-00b0-41ce-a6be-3438c7b57348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750454, "uuid": "857409df-0948-4cbc-ae3c-4e96bd30093b", "value": "12288:I6Cv9//HK7zYK8t54h+lmY3RUFfdmT6Mnjx7lwQr7SKmT1aNOUX3YY4ufQkeB/R3:IlckGLYBUBdo6qxppS5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750454, "uuid": "8e83000d-f328-41d3-ab12-ca2e9a67108c", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750454, "uuid": "2e8fdd79-e214-4516-b129-b0496c9eb189", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750454, "uuid": "bf379966-07f9-4b07-af57-7f3535a9f236", "value": "b34575c36f5e24cd748b8cac361f7009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c53287a-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738371, "uuid": "584b1d25-e060-49dd-9afd-5966cf9fafa2", "comment": "Malware payload (Mirai)", "value": "bd188fa9f8a6fdcc8381e7d8b03476c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738371, "uuid": "e248a97a-f1c4-4f43-815b-f20a7d630677", "comment": "Malware payload (Mirai)", "value": "5906899d27ad3fe4e5f2c3fa98e2f370885b0e053b40308e164759dc851b7e85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738371, "uuid": "c80f9304-fabb-4f47-bb53-106993c86c6f", "comment": "Malware payload (Mirai)", "value": "914f2f6cc31c2941680fea0bc1037adbe53af786", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738371, "uuid": "b7ba7693-10bd-4e57-a8e1-7c8b75045eab", "comment": "Malware payload (Mirai)", "value": "de90851c1e37b7411cfc3bef4c601c4bac818af034ab633d20d40944d198ad1f5931d885853ef0ef87cbd5250dce8db8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738371, "uuid": "73a62557-5943-42d4-a61a-fcc8a887ec72", "value": "T170A34A82A740D5B3D19306F6129B8B150133FB3F4A6B9EAAF35D3CF48B109C57221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738371, "uuid": "4805b60d-c3c6-44a7-ba1a-0e962e62d3d5", "value": "3072:dUICodUWUh917j8mc2deiPUDAZURyPfR5hVT5vxinf0OzTyoQQub:tdRu917j8mc2H5Z5P55h1Vxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738371, "uuid": "2a01f14b-ac7b-48ba-9d70-8fee9eedc8ed", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738371, "uuid": "266b6aa5-967c-452e-8057-464d9c36d2c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738371, "uuid": "e1aa8199-4dc0-44ea-8ce0-b9a7815041a9", "value": "bd188fa9f8a6fdcc8381e7d8b03476c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79194072-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628750553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750553, "uuid": "3e6df48a-c725-4c31-ba7c-036ba162f5be", "comment": "Malware payload (RedLineStealer)", "value": "72ed407fbc0007404b05abc1a8b66d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750553, "uuid": "339b6891-dc4c-48dc-b24a-b46d06038269", "comment": "Malware payload (RedLineStealer)", "value": "5920f9887ebfba9838fbbfda9530dd2923726a6317e6edbfde85e61bd053fb1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750553, "uuid": "66610e75-d264-4899-ada8-2f74698453db", "comment": "Malware payload (RedLineStealer)", "value": "d1a1b6a76402387cbda30b31b54aaf0717c0e227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750553, "uuid": "21a3f981-dd70-44f9-b6f6-c744cfbf8137", "comment": "Malware payload (RedLineStealer)", "value": "8c40acf7e1acc4fc58c18faed54ac9395e6f5a6d34b676ed0b3d8ac8e6a10b0f9194a1611ddf3f1fd8989e496f3928ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750553, "uuid": "a7b95b9f-49da-490a-8eb7-7eb5c5d1d47c", "value": "T18FA4F14372854741D98459BA84EB243513E5ACEB2A73DB823F08B3DD5E613B3DE8178E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750553, "uuid": "0d8762ca-345c-42d9-aa5d-0b199ee278d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750553, "uuid": "1baf277f-93da-4db5-b146-9dc0c65bddc9", "value": "6144:1l/smPBvY/tMuVWw1Nxx8oNIcfdo/IkYMw0jnj/qQOUZ6CMCrhp9ZXTLfMobPUn:UmNYVL1Nx6+bfdo/I9MwezqbyHVYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750553, "uuid": "7612cc88-11e5-4707-9a26-ad21b3861555", "value": 475008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750553, "uuid": "a193686a-1b12-4fac-a2b3-126c594623d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750553, "uuid": "dfcbb747-cc94-42da-a4a5-5df3f9cb0891", "value": "72ed407fbc0007404b05abc1a8b66d6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf37f5b-fb19-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628737379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737379, "uuid": "92cf922a-39d1-41e3-9a6f-94f2ba86b640", "comment": "Malware payload (Gafgyt)", "value": "2c5d8ebc749f9cfce23cbb7163b8189c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737379, "uuid": "8923af44-d4e6-48fa-ae6a-82bb893ce291", "comment": "Malware payload (Gafgyt)", "value": "5933ecfa682b3f76f1b5425c2f7e2833c27b94ce1df2a1f9dfcbb6f5ce4bb41a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737379, "uuid": "b1c91417-074a-4cbc-b533-9b5155ef5c17", "comment": "Malware payload (Gafgyt)", "value": "a3f47e41f905a38dcee427b96d3c6bd3435ade8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737379, "uuid": "934c54c0-89c0-4fb1-9749-df7737ec13e3", "comment": "Malware payload (Gafgyt)", "value": "eb36a1041602cf4b5597daf3b6952836548da8f969d81b6881b27b1a144d2e73fcdd8f5b739431827da68c78e444365b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737379, "uuid": "f92581b9-f24c-4cb9-8254-2a7e21ee4826", "value": "T1FF931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737379, "uuid": "d4b588ba-c639-4336-bc77-308072df5eed", "value": "1536:EIkg9VQPAWlMTEb82Mm3xDKMsF0rOLcv0NPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQBMTDWWFG0NPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737379, "uuid": "8d3af8d6-4852-4ae9-a518-3f70e8d271e6", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737379, "uuid": "b57930fb-0ad1-488c-becc-2ffa9aa2a248", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737379, "uuid": "16493681-a54b-428e-9fc3-1d7ad41c07b6", "value": "2c5d8ebc749f9cfce23cbb7163b8189c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c7db39-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750366, "uuid": "35ad7b6a-685b-40f9-95ef-204f8b8cc274", "comment": "Malware payload", "value": "1909c38d2c35ed41c7f9cace64a041bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750366, "uuid": "c000d6f8-a3f4-440e-ae5e-1a18ba4ce7a2", "comment": "Malware payload", "value": "596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750366, "uuid": "9df16064-21ce-4a73-8219-10ca366f8714", "comment": "Malware payload", "value": "2789acf1bc58720b74e62c64fa48da2f2ba290c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750366, "uuid": "77da8be5-6376-4e3d-9b60-6059efeefd4b", "comment": "Malware payload", "value": "e85162518142db8a85a1fe7dc3026588efe283e5e85070feac5ecd5422e24e7835ccfd7ced48dcbd8bc0cd4834342f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750366, "uuid": "463de21d-cb0b-48ce-ac5d-11cc961a5ab1", "value": "T186B4D030AB90C031E5B612F845B693BC692D7E709B3950CF92D82AEE16346F4ED31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750366, "uuid": "5a77fb87-573b-48e7-bfcd-91937da30a04", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750366, "uuid": "e3be9b63-68fe-425b-95a0-e5dd9974a7e5", "value": "12288:iS5kXIdaQgPDwwZGMaSJndEJ7lhQMxshdKF:re4daO8dEJ7fQaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750366, "uuid": "7aea44e6-4791-47bb-9562-37482c762e83", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750366, "uuid": "4ce879da-de1b-4929-89d0-dde31658da99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750366, "uuid": "e8f4442d-abbe-42a7-8bdc-099f741001e0", "value": "1909c38d2c35ed41c7f9cace64a041bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6633ea08-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750521, "uuid": "af78001d-1488-4af6-a907-2bdfeb1be28b", "comment": "Malware payload", "value": "b57cccbd505af23f21fa72654c8a465f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750521, "uuid": "338c400c-ee57-48c3-912b-23dc8bd14204", "comment": "Malware payload", "value": "5b28e6ab7a9c12a734c1e8505ddfd802511d7f2200de25e9f1d6a62a4d1ad6af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750521, "uuid": "04bfebd9-1996-4025-ba41-5aba4af9b0ee", "comment": "Malware payload", "value": "596bf83d1495dba68cf506e3927f94cd123c4eba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750521, "uuid": "bd7805eb-df6b-443f-937e-5edbc3d2059c", "comment": "Malware payload", "value": "a77bb41340ede6ce85abf692b366ce7fcbabafb83ad33e30747753eca33af575668a6f2f1524b07d0faa447c13edf84d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750521, "uuid": "ce223238-c895-4e5a-9959-4037643990ae", "value": "T128E4AEAC764079EFC917CD76C9681C60EA61A47A530BD203A05712ACDE1DBABCF152F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750521, "uuid": "264e8769-d967-4037-b4a4-c889ec35e791", "value": "12288:adnZsR8MqMFojRhNLfg2I4+EXm5BPlw1UruFXEkWLshFLkUkoKx65m9/BAISzwFM:adZ48MqMFojRhhY2IKXmJsUrbktSvo8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750521, "uuid": "5dec1514-4c00-4cb0-a040-b024111da2d0", "value": 658511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750521, "uuid": "b0e5988b-77b2-466d-bfeb-2870ed5964a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750521, "uuid": "76a8d40d-7d47-46c7-a3f8-b55ca992c8ac", "value": "b57cccbd505af23f21fa72654c8a465f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33adf1c8-fb27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628743135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743135, "uuid": "b0db6470-7704-4f5c-984f-671bc2fc2513", "comment": "Malware payload (Gafgyt)", "value": "eb9f3e246680ec31b1c37c38539f8e79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743135, "uuid": "703a0cb2-7299-4802-bc9b-cb3b60558875", "comment": "Malware payload (Gafgyt)", "value": "5b4f37135c60af22854a54844bc231c55ff6329457b5118d47111027039d3733", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743135, "uuid": "19905753-6f9f-4a5d-bb96-5f5934cb8579", "comment": "Malware payload (Gafgyt)", "value": "412ae94ab8620084e37265bb71486d0bef65a717", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743135, "uuid": "574c81bc-7726-4976-82e7-78b8632a646c", "comment": "Malware payload (Gafgyt)", "value": "176093e2128039534308b0d78c255d4ff9242b1428c4ab817b9c0b5ccd2950b773af52c384aff90a4f1b52884b06acc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743135, "uuid": "18be8150-4bf6-4e04-af39-976767d812a6", "value": "T19E433943771D0B43C06BAAF429F717F087A6BD601AA75284E11DFEC4A332BB46925F64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743135, "uuid": "c35e7c57-7a07-4c93-a7a5-d70338026b32", "value": "768:7FUvy4nO9oN9B5iPn0xTieCFGBt2wJpISGInSgUT:Br44oLB5i/05iEBUgpVGISpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743135, "uuid": "6760c407-f150-4e11-a51a-6f94a3514fb7", "value": 55218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743135, "uuid": "cfdd6d12-1b6f-43fc-9974-cf4adad5f5ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743135, "uuid": "2fcfc393-58f6-47f7-88ff-bbaee4b1610e", "value": "eb9f3e246680ec31b1c37c38539f8e79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439fafcd-fb28-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628743591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743591, "uuid": "9d2e6726-a9c1-4db5-af39-220dc1295be7", "comment": "Malware payload (AgentTesla)", "value": "36e405c13bdb91f28d3ad5e494625c91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743591, "uuid": "6905f09d-09c0-447c-b117-2f97828f7c9b", "comment": "Malware payload (AgentTesla)", "value": "5c32a108f641e44909abe928e9d4a3d82683b85bcd42e0c4723eadea5d80a6c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743591, "uuid": "861cca51-7fe7-4a60-a870-cf82bd012f36", "comment": "Malware payload (AgentTesla)", "value": "8a9e527199b3899547680596ec9e06baa0a3ecbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743591, "uuid": "ec8307b1-717e-4fe5-a76d-3e8e5fc7ed13", "comment": "Malware payload (AgentTesla)", "value": "e51f9c2d361df97b233b1ba9a92a7fdf83472c0f6924e7c5e54b8855a7c58cea3c63267ef80e6cf56f8a964dfe54aa3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743591, "uuid": "aad704e5-b931-47da-9f6e-cc7caf0f3401", "value": "T19405BFAD729472DFD867DA72CE642C60EAA174B7471BC207902305ADDE0E987CF146F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743591, "uuid": "789a1f71-6f84-487a-bda3-bcae8b88130d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743591, "uuid": "c7924038-e103-4240-857e-634db60ac115", "value": "12288:lT/HK7zQemMjVwgKdTkc2XhtkI2EvnFhUi3dfnOquCqyBS5JcmOVEc73jzckwlke:ArbGVYB2EvnrUiNPOdyBSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743591, "uuid": "7592ca71-d54a-490b-bac9-fb218be062ea", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743591, "uuid": "e41579d3-75e8-4c75-8612-a15b9edb5603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743591, "uuid": "f20a0224-db39-4a1d-b6ae-271242a876d9", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10817731-fb49-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628757679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757679, "uuid": "bce6c84f-a998-4089-a180-51c9aad0bcf7", "comment": "Malware payload (SnakeKeylogger)", "value": "f214b97d081f549c3527c0b1f2631b21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757679, "uuid": "125dfda9-2b18-4b84-a757-1f23f3b217e2", "comment": "Malware payload (SnakeKeylogger)", "value": "5c48b185c563d651a20fa4c212d08550810f1fd459351ece28509805061b19be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757679, "uuid": "d67c7cd3-73d5-4f8d-b0bb-247ec5a2ec99", "comment": "Malware payload (SnakeKeylogger)", "value": "8285783bee73f84baa5c6eab704eaf47ededf987", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757679, "uuid": "bf3763db-68af-4f6a-b0ae-ef32a49cd021", "comment": "Malware payload (SnakeKeylogger)", "value": "ed5f8d20bf8e5bbd60758f262886465a886c562301462f7929a142e4ccc420413b6dac99b911c14f7b32b3846e7cd2df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757679, "uuid": "a136acab-d8be-4d58-a8e2-18b5f4d3d696", "value": "T192F4BF9D369472DFD427CA72DEA81C60EAA1B4B7871BD207901315AD9E0E987CF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757679, "uuid": "a8986a8a-b6df-4990-9c09-9bc3ed0a386a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757679, "uuid": "f6bad3db-12c6-480a-8bf4-ca5def67c2f7", "value": "12288:sqCoL4/HK7zcixJmab3QxFlk+Xr5uP0rbhNIxUFUzfOORB3fAzq3Rc9gOHkOuAig:sZ6fgixJPTq5XrUP0rNaJS+B32q3R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757679, "uuid": "5ce9510f-b70d-4dd3-8074-f88098e809b5", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757679, "uuid": "0ae03402-0959-4d1c-9b0d-3cc924507c25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757679, "uuid": "d98f16eb-5546-436a-a76a-fca75c8a0029", "value": "f214b97d081f549c3527c0b1f2631b21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e7e566-fb01-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628726756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726756, "uuid": "bb2e5358-a8e7-4dc2-9e0c-8167a335eac2", "comment": "Malware payload (Mirai)", "value": "b318686399480f746c7958db58f0e3a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726756, "uuid": "207601f2-b1fc-44b1-acb9-cab8badceb71", "comment": "Malware payload (Mirai)", "value": "5c5f8cf4a724c61e03c5a6cd594a7fcce9d6be5e8c16831e257757c7b739b88a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726756, "uuid": "8c2ef653-acb6-4c14-8bee-d566e40831a0", "comment": "Malware payload (Mirai)", "value": "8a58107abe320556e06e17547248048b768fb142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726756, "uuid": "82bba491-f7ad-48f5-a3a4-362d30d9876c", "comment": "Malware payload (Mirai)", "value": "a47f85faa871da57fff125549c4b5feec7d12126b68e14f722ad25a88bc0536e73c828d0503754d3c1c43d37b720bb70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726756, "uuid": "f9af9cd1-6906-4bc2-8479-4710517ef05a", "value": "T13333F861B8926A1BC6E0237AF9AE558D332063E8D2CF3217CD201B157BDA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726756, "uuid": "625ec712-3df8-4e32-b4f7-8f6ef9b31b0b", "value": "1536:aymy2hHuA6bBvUImk2ifflvYs6Ioh+kWXXkQ:aymy2hOkds6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628726756, "uuid": "c595edf6-8dee-4f3b-b330-1747d4232377", "value": 54652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628726756, "uuid": "313c5126-4f66-4d75-9e96-7d79cdd21641", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726756, "uuid": "1ccdfbf7-f32a-493a-98a6-9e3d79551835", "value": "b318686399480f746c7958db58f0e3a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4be334-fb49-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1628757722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757722, "uuid": "553aca09-bbec-4841-ac19-d79fc66168c2", "comment": "Malware payload (Hydra)", "value": "6ebeb85ffe32db161606a7c53722b890", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757722, "uuid": "7589a442-c2e7-4e5d-8342-131194fc7012", "comment": "Malware payload (Hydra)", "value": "5ce41f4ecbfa8fa2855689ec3cfc1015ccf17f00ad28fa3bd26b4b8c86c56ad9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757722, "uuid": "c14fc8ac-96a3-4a58-9973-4dbec7efb146", "comment": "Malware payload (Hydra)", "value": "dc93b4458efebbc4a15a330840f0c92359e4de95", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757722, "uuid": "6e66b8cf-88a7-4702-8ed5-02165fa67cf3", "comment": "Malware payload (Hydra)", "value": "02c4908ddeb16355eb577a43f07df5d9954d8e09fb0692d225b9ec6747634325e4add452875c5e6f8a94e7f79f91895e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757722, "uuid": "c47f7f15-6251-4892-8adf-d97d276130cb", "value": "T1E4E533696D9AD02DD70B6C7048108817B26756E83E905E9F0C725A843EB1FEC4BA3D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757722, "uuid": "3696d241-75ad-4d57-acc7-b55b0c500fb2", "value": "49152:92UEyQygv2WCra6iKmRxdehYOE82PNSKpekboCtEQeiem9b5oZ9kw6PZzjC:92Qgv2WSa6ir8sSb6oCN5d7Pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757722, "uuid": "bd56da55-0430-44ec-aa17-9498ce53f033", "value": 3115783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757722, "uuid": "58fe662b-a8f1-4b8d-8329-8fec8652b61a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757722, "uuid": "097f678a-4b93-4cfc-82f8-40f8ac98162d", "value": "38157_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a4160a-fb4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628759692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759692, "uuid": "34436370-5315-40b7-a21f-ba22a453e14c", "comment": "Malware payload", "value": "6869f23998ed1d86b27b9f6732120719", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759692, "uuid": "b4a4f79d-dd61-4de8-b2ed-f580c3c5e257", "comment": "Malware payload", "value": "5d3a727a14ed34071e2eed3ff53a95497f9ea615e3d88313836a2df9cfd311ca", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759692, "uuid": "42b7d296-b694-4f8e-bc71-2f6a7cf84baa", "comment": "Malware payload", "value": "7090f2254da317c5d208cc1098706d335b53ddef", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759692, "uuid": "6bd1c9dd-724b-409d-9d23-715562a8e5ea", "comment": "Malware payload", "value": "de25d7a5b376f10477b5ed3de76dc8976fcdf52758377816a71d68c26c8171fec27f55464271153eb1e7e64bdbe8fbfe", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759692, "uuid": "f797ac5a-fa3c-46bc-89f9-45e6d758175a", "value": "T1E2562381F39EBC1FDC7784328BB64B2A13464C068696D7175969B12C4DBBAD04F8AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759692, "uuid": "494c5d53-984b-4d6a-8179-48ed9fdde9d2", "value": "98304:zW+QyeCC9ySuJaggfSh+g9AnZ2uSV9Hz6WKXtRzADYYyPzl/ly:zACkjuJag/h+v0uOTDGtRzX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628759692, "uuid": "1c5e8e62-b7e0-4250-bf2c-d5e1b088b3a2", "value": 5963572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628759692, "uuid": "36cbeeb6-09ac-4a30-9e9e-9d43b7bed243", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759692, "uuid": "8965c54d-8519-456c-8847-e15a4c5bdbc9", "value": "7090f2254da317c5d208cc1098706d335b53ddef.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af02b6e-fb99-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628792056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628792056, "uuid": "1a8474c5-af57-479d-a582-94a4a6c39ab6", "comment": "Malware payload (RedLineStealer)", "value": "1d8f32a4bcd066413acbb8c4bf6037c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628792056, "uuid": "ccee5fbd-795a-49d2-9eb1-4b1768e43385", "comment": "Malware payload (RedLineStealer)", "value": "5d682001504dc58701765ca9721e4b4b9eb5b5e73469731fe787d15217cd7435", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628792056, "uuid": "cee39fea-0336-4db1-8c11-1bb4366109e1", "comment": "Malware payload (RedLineStealer)", "value": "039c71f5a96b4c079671c46515d8af15720f81ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628792056, "uuid": "f550b09d-07e8-41d4-a4c8-9b5e9f327956", "comment": "Malware payload (RedLineStealer)", "value": "9b78633342d6610fec163e80320828176a522ac3aad3f50179daa263e5e7acac80339fe1fee8eb091fad61ceda2141de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628792056, "uuid": "7c8bd56d-7207-4ca1-b2d2-bdb4c07b72a2", "value": "T103367CB032058ABBC0494DB9E0A5EA3791A13ED547709597E9C63D3A3B339CB64F0F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628792056, "uuid": "34bb9404-2ee4-46da-b41c-c692c072d5f5", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628792056, "uuid": "ff584f1b-c6ac-4ebb-a83b-98a804e52c8c", "value": "98304:JVzGNV9HkAK+sGxBlPKHj6ePKVpP+JRILRe/FaEZeSoPdVaKU+Ft:PzGNVyAK+txBliAVpPYGRe/FPD8dVaKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628792056, "uuid": "66881e4e-e14c-4676-9d44-c74384991b9b", "value": 4943872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628792056, "uuid": "9651667e-0e98-4c19-a03d-8facfe2d9a05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628792056, "uuid": "bc2a26f1-c268-4f07-812a-3ac6e2da6347", "value": "1d8f32a4bcd066413acbb8c4bf6037c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e0cb3c-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1628776404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776404, "uuid": "22e3fdf7-f259-47c1-b8df-8e55a6f10374", "comment": "Malware payload (KPOTStealer)", "value": "17dc6fd51e152105d529f347fcacf21e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776404, "uuid": "af34573f-8b10-4ed9-896b-543d36215862", "comment": "Malware payload (KPOTStealer)", "value": "5d7bc178cb3eafae7b2c99b2cfd2ceec87119cf2403f86af87435d4479f36724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776404, "uuid": "a870972a-c19f-4a60-8dc1-e94d5432b319", "comment": "Malware payload (KPOTStealer)", "value": "5b91d933af6a7b1a5fe0ef3ff829b1e0044b2ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776404, "uuid": "568efc72-3527-4625-9e5d-af9123b5d1e0", "comment": "Malware payload (KPOTStealer)", "value": "dc13e89d19aa9b964f3c5e51da6bdf5e0dceba0d7827581944e536063036548c6241eea9fd88289cf3fceabf45c41c71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776404, "uuid": "213249aa-f6d3-4d52-ad79-47e028ec04bd", "value": "T1E5A4C030BB81C035E5B712F845BA9378AA2D3EA0977490CF52E51AEE47346E5EC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776404, "uuid": "26f92528-31b0-41bb-8a3b-682f2e99a070", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776404, "uuid": "2c5e92ce-7c40-4815-ace9-d377782960a5", "value": "12288:viDHKIAVjf7g8BaP7Hc55+CghrP0P//PK:qLJAVXaHP3ry/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776404, "uuid": "51d3c819-3ec1-4cf0-912d-12b76743f295", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776404, "uuid": "39ff6743-b07f-4327-b9d1-0c173f97bda9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776404, "uuid": "95da0ad7-ffa8-462f-b90f-389406012d54", "value": "17dc6fd51e152105d529f347fcacf21e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2ab59b-fb19-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737403, "uuid": "a38f254b-b912-425b-896f-17d477591e1d", "comment": "Malware payload (Mirai)", "value": "a96707fa1b1570ffb00b9ecfb07b1b88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737403, "uuid": "a1bd8402-7f0a-4b2a-82cb-be9a3231eaac", "comment": "Malware payload (Mirai)", "value": "5e28b9e6a57c482b39144cc15e5387de8d8e3ce9422539ea87e8ea76d22f35ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737403, "uuid": "9f9ef55b-fb70-42bc-8bb5-bdcba835b014", "comment": "Malware payload (Mirai)", "value": "dd1d3b455b985d1127085a9a88628626560584b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737403, "uuid": "7cd5de8c-94d4-4016-8e90-8bdcb821a7e7", "comment": "Malware payload (Mirai)", "value": "711ff42c2fb202343e4b9c3632213aafc7024ea6665d291511e0df240789a17533d908a0ba54c8348525970f11beef9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737403, "uuid": "d9260675-af99-45bc-90e1-1cfea9743265", "value": "T164F2F1A5BB19EC31DD70143BD8D8ED825DC11F74EAA6702B041256BD97822C72BF28DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737403, "uuid": "b63e90a0-112c-4ca8-8a2d-07450b3c0704", "value": "768:YL1Xbnn+KP8jIdgVEAVjBdF3Mps470tGknXlbL6U9q3UELQz:Y5TizhF3MpNGXlPELq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737403, "uuid": "b3c87bab-0868-4c5d-8eee-efe857e30ab9", "value": 36272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737403, "uuid": "b3370a87-f4b6-4795-8b67-d03412a607db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737403, "uuid": "68037563-6c4a-41c5-89fa-493234a29314", "value": "a96707fa1b1570ffb00b9ecfb07b1b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d446d6-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628750359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750359, "uuid": "24cb78de-8232-447e-a0d1-c0f906a94608", "comment": "Malware payload (Loki)", "value": "e9c8b2df79184fbe5b97854f53f28bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750359, "uuid": "b5947075-baba-456e-984e-0f0f36e99c1a", "comment": "Malware payload (Loki)", "value": "5ee842917f1dd40b07e05e22fd23c051fb795422ab8bc70af4435128c73431dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750359, "uuid": "e172ce61-8463-4580-af5a-24e076cc9c1f", "comment": "Malware payload (Loki)", "value": "d3e25418978afb7fb3ca1daac5316f5d16838ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750359, "uuid": "ed2c2d86-640f-474f-9623-a1c91c8d0ae9", "comment": "Malware payload (Loki)", "value": "3931d7f67f6cc3139058dc21bb9d0837fbf47bb7d8d8ed79c139f40db1ce4ac516dbadf80b1d8ee0a3d57af7d146b224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750359, "uuid": "6fde19eb-ab39-404e-98ae-b9ad040d964a", "value": "T1D2F4BFAD369072EFD867CA76CEA41C64EA6174B7831BC247901701ADDE0E987CF146F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750359, "uuid": "9f2de35c-06e5-4b9d-acdd-6884cedb7f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750359, "uuid": "953f0a7c-a503-40ab-963e-f1d420d6061c", "value": "12288:BTb/HK7zqL2kvXH+Q6eQha/jpUCtMBmRI0za547RLMB48YAKORxml+rnmeV+9JNx:ce7XH+EOKdz/7RAfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750359, "uuid": "c0867d67-d3ff-4cd4-9db6-82771455a8f5", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750359, "uuid": "d0249ab2-1d42-4198-a318-ce44ae923f41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750359, "uuid": "c3f22e1e-8fb7-459f-b8f8-869c99b7e106", "value": "e9c8b2df79184fbe5b97854f53f28bdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64dd10f-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767084, "uuid": "50479243-403b-4ff2-83f7-1d088c7427b4", "comment": "Malware payload (Nitro)", "value": "23e768609a0da73f7db18836ea7c8305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767084, "uuid": "d210ee84-52d6-4cab-9d41-9d50a12fe0c4", "comment": "Malware payload (Nitro)", "value": "5f7c38b162bbd0cfef8dd27ab8ba47bf20f187dce05e045494956e2306995db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767084, "uuid": "53900d1d-75bf-4abd-ace4-efd05b7de63e", "comment": "Malware payload (Nitro)", "value": "e164494fd6d5ab908971cc1d4f24f0295ab7d400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767084, "uuid": "6661f6fe-b1dc-4c22-82b3-44abe308e521", "comment": "Malware payload (Nitro)", "value": "e67c8d0c84770973e1f24c31da3140dfe17f7c3232f07b76e724ca875d33dada05839efa0dae7cfda93d95b3a6b465b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767084, "uuid": "e1a0b92f-a78a-4a60-a484-240f36f78ea4", "value": "T1B853542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767084, "uuid": "16eecc99-0666-4731-ae3a-e38d09994535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767084, "uuid": "5c56668b-dfc0-46a7-a15e-4fa1d7a3d309", "value": "768:4KsMqCXfVcWO/M9ZkiANIUVcYLDwUzc80gmq3oP/oDi:4KseiM9ZkiAPTr/0O8/om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767084, "uuid": "1b6d4e2c-85c0-485d-a1aa-72a75ec56f5e", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767084, "uuid": "1faad018-38c3-4a74-8248-30c08025cec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767084, "uuid": "4435322b-daed-4609-9b68-14a9573c31bd", "value": "23e768609a0da73f7db18836ea7c8305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28696b3-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766997, "uuid": "16f9689e-f5bf-48e1-b920-e75f87f735fd", "comment": "Malware payload (Nitro)", "value": "8e6c0da213c278e63ae692a8dafe15e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766997, "uuid": "cfc3a372-c919-4f18-a53a-f2b67434a491", "comment": "Malware payload (Nitro)", "value": "602908a365ea6602535c825d2b7423ecb4a4ce5597b3114be289794a7a54d7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766997, "uuid": "6c8859ee-7643-434d-80dc-2b4c23bd72b9", "comment": "Malware payload (Nitro)", "value": "f8e74cbbb667e0d60699e7b19ce4b688a468f082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766997, "uuid": "3503668b-e0eb-4712-9e2c-66aabe420d92", "comment": "Malware payload (Nitro)", "value": "ca9585a172749bd96a958e079244ff6f9cb2341f484f730539fb18f3c6ad05cba6fe374f8054f885235ee3031a4f718b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766997, "uuid": "105dcd11-7dc8-4d11-9364-6d584225354e", "value": "T1385365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766997, "uuid": "35789614-c23f-4e5d-b86a-ffca896ed032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766997, "uuid": "5eb035d5-fb30-418f-81ed-e16669e983fb", "value": "768:POucKn7n1JGDNANIUqLyovLDwUzc80gmq3oP/oDas:PO2GDNAPquer/0O8/oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766997, "uuid": "5bcba78e-ffa9-4ed2-a1f1-717c83bb9fd2", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766997, "uuid": "2de50630-e763-41ea-b7ce-8a0ae9b2cff0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766997, "uuid": "a5024423-0b5f-4334-b01d-3207721fe460", "value": "8e6c0da213c278e63ae692a8dafe15e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54f9cc9-fb98-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628791912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628791912, "uuid": "515d92e6-5e92-4692-b023-644d330ba78d", "comment": "Malware payload", "value": "5eb1b44173860d48c668c67aa06bd87a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628791912, "uuid": "967cae3e-fdaf-4ed5-99d6-8f8412a8d6aa", "comment": "Malware payload", "value": "609ad6e76d530045e6935687ce095fa4792dd73b2cf2fde26dec1d0aeef4d528", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628791912, "uuid": "d1041329-88f8-4d31-881a-ce318a9e92c4", "comment": "Malware payload", "value": "8fdfce112c3259123b2b8d78da27aa03df17be87", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628791912, "uuid": "d955860c-d9f7-4fe1-a764-83f24d668027", "comment": "Malware payload", "value": "b453bbb534151d6c828afa194b2965b6661ebdbf22318d3c0ebe7960eca8d20bcb2e760ffced6742d4439f0c09ba8221", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628791912, "uuid": "9d0de99b-5ccf-4ccc-b91f-433e4a1a61da", "value": "T16EA50143F365E822D477C23266355236A15ACD588F07FB57290AB76C6CFFE948E84AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628791912, "uuid": "b5fbc2e9-6504-46aa-958c-ad1e1f4ff0f9", "value": "24576:iOTtMtibTdnH50aCRYocg0ZaHYdvhLqso0mbkDrsOhpMjg4OFgiWV7N4tmX9iU/S:iOVGrB0LpjROEhOpLv4tm//S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628791912, "uuid": "f95caf4f-59a1-44f0-a9c5-724d8f3adf14", "value": 2111858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628791912, "uuid": "6a3ffd27-dd59-437f-b9cc-eccbc292d676", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628791912, "uuid": "9b771252-1a1e-4a38-a3da-74bd9fc17fa3", "value": "Downloader21.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54492173-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628750491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750491, "uuid": "701b8ab3-1daf-4cff-83cb-e1a6f5b6ee7d", "comment": "Malware payload (Smoke Loader)", "value": "98c6d84ba1f1a2e26bd3099f08226f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750491, "uuid": "0a94dd5e-7d9c-4efc-b2ed-8e569c76c39a", "comment": "Malware payload (Smoke Loader)", "value": "60a5fe219d6e7aa920bd6684f7e34e4fb16ae3cc38e89f053e98aa7936ab91b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750491, "uuid": "1363991a-5c05-4064-a589-5ee67b72ecac", "comment": "Malware payload (Smoke Loader)", "value": "35ca7664747c11abf4aeff57fa78ad5bdf503df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750491, "uuid": "75c0c433-dc47-45fa-9077-75137f075f37", "comment": "Malware payload (Smoke Loader)", "value": "05ea5553b622fc4a58f10781f809601c3ebd7394eb6e8d6bda6471b855d657426681db38aa25df49b2e19124a397d959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750491, "uuid": "6fae93ff-b521-4d3c-9e77-1d1242cc6d26", "value": "T10F24CF11BDBCD832C495053844A6CBE8267FEC647A54054B7B983BAFEE707E1226374E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750491, "uuid": "5b8c5540-e559-4144-a76d-0034c8de9d85", "value": "5ba12e6852ba82499f5822056a147515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750491, "uuid": "34bfe81f-b608-4be5-89ab-cd1ec60eb822", "value": "3072:ywAEjyMmef9Uey6AotGDtZnDHlCJmbQ53tDq68ScsYh6gSVywo3c+:nocFAoQDtdQ9q6v7knGyHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750491, "uuid": "0880461d-85c7-46e3-865d-40e6e632b770", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750491, "uuid": "f9bc935b-2d2a-409b-8ac0-16b863b88f4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750491, "uuid": "9b7c98aa-373d-49a6-86e2-746e85b5ad53", "value": "98c6d84ba1f1a2e26bd3099f08226f09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84cf54a-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1628776402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776402, "uuid": "3a393b56-8bfc-4842-bac2-076c96c86ebc", "comment": "Malware payload (Alien)", "value": "d780257e0bb666be027137b631af1c12", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776402, "uuid": "3ef26075-2e24-42b0-9389-d26e360ee269", "comment": "Malware payload (Alien)", "value": "617ec2c8e213b27bee59716033fe62074986872d31c30376dceb7e737e3533f6", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776402, "uuid": "c83927a2-7522-4326-ba43-af88d9eed4e4", "comment": "Malware payload (Alien)", "value": "44935c16e5e66978b8950f81f3a3b2273edc6daa", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776402, "uuid": "64229cc8-5c85-4d71-9862-8998d13dc037", "comment": "Malware payload (Alien)", "value": "b193506f415ae31991af34036df9581467803e8463906843dd4024cf909590e5ceaf0c0a952718dc319b74465aed1123", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776402, "uuid": "f515a2e9-124b-41b1-8e65-821ca4ff2140", "value": "T191E5335AEB95C8C9C71BC2B14057395373E6922F62D2A43E1533009568BB9F48B46CFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776402, "uuid": "d3f9b852-ab1b-4cb0-956d-e2a045b5c981", "value": "49152:tRCnMKa2mz3yutQroZRydxCUuHLZeNvuDTYqVL2EWFriBm0ELjTIRtw:tYnfdBoZQd7ACGvlVLuFWIpjTIRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776402, "uuid": "39b5494d-5d08-4edf-86dd-d4d6a3b33a26", "value": 3019755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776402, "uuid": "c3dc738e-de6d-487c-a40e-50cf52a67a5a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776402, "uuid": "3764d57b-a876-49c2-9630-22b2d2e9a19d", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3866e6f-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerber)", "timestamp": 1628776394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776394, "uuid": "771ceaba-cc64-4dae-8f55-1df248e33526", "comment": "Malware payload (Cerber)", "value": "832f4d834e830fdb1109a0aebc55ace7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776394, "uuid": "cf20ee24-e80b-46e0-a1fd-695794e23559", "comment": "Malware payload (Cerber)", "value": "62a7a7f546d7003809b9d3b183d9bb15ec74358e726dda8e172c94e773e20045", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776394, "uuid": "fcbe7ac4-14e0-46e7-bbe5-a7e20902fad6", "comment": "Malware payload (Cerber)", "value": "ed03de568c600fac7078c4a95f323a5f5c211493", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776394, "uuid": "6f76d441-9319-41e4-81f6-e63cc07c38c9", "comment": "Malware payload (Cerber)", "value": "1bfdec24b687130ff7b164dbb4d8221bd6f1bf3edfa9c1ef3d7ef90f0b6df209c45dec1eafb4b7ae69d3a054b0788e8e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776394, "uuid": "2e1e00f9-ae65-443a-8c13-adccec59f97c", "value": "T1C9D3F153F7E0184DE2BBB938459DE3326AB29D80A7D0D3D23919402C9DA336B1F5CE59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776394, "uuid": "37b92092-aae3-47ab-8da2-eefd3d01accb", "value": "3072:6wfy5teCzlsv26jf1D8yh0GuLuIQ2XzXcvZ:6Ayn0Rjf1fh0GovQ2jsvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776394, "uuid": "a599841c-508a-4fd1-b1f7-1b952ddb62ab", "value": 136627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776394, "uuid": "0e48236b-266d-437a-abe3-2f32ac782296", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776394, "uuid": "d0e02eba-dff9-4e00-a80f-1b5fa468df2c", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414a3f8b-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628755184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755184, "uuid": "915d11ce-07f9-4c6a-bcf5-8fca913bf9dd", "comment": "Malware payload (RemcosRAT)", "value": "afe3d8e88524538f78ed9ba5a6199f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755184, "uuid": "985a1398-a0c8-4f2d-9a09-0de30ecb2f37", "comment": "Malware payload (RemcosRAT)", "value": "6306a84af848d10856e8dc13e9d0000d32dcaa129be195ede37eadda4cd7e3f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755184, "uuid": "b8b5c218-faed-41a7-b046-c554cab3362a", "comment": "Malware payload (RemcosRAT)", "value": "3e5d65019e2a779a72c107f9c5619c13f00085bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755184, "uuid": "c812b578-fe62-4fe2-b6a9-543b8cc066ee", "comment": "Malware payload (RemcosRAT)", "value": "01ab2bd3a773ee6f16f4fab108fcd732c45c1ffd00cdfd4ecc178004829bc6b0fd2bf3ccff1279d06433a1e1aec7d858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755184, "uuid": "f1951b53-f497-4090-9b75-2146f62fc4d1", "value": "T1CDB4F1F17289C6F8D461523158CE4A325B26ED317E5F8E2F33842B3E36605D33964AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755184, "uuid": "8dc0da87-cd41-4400-8dde-080ac4acc935", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755184, "uuid": "9fd54f84-302f-41b7-9873-a1b090d4ecab", "value": "12288:ILPffRB7Yg1iBWgG/aeIo1qI6YGpD9FMRabhJ:ILnJB+G/aRIqvYGHFMRaNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755184, "uuid": "a4325ad2-3f2f-44ce-9c71-b3a49036bf20", "value": 510311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755184, "uuid": "935c9bc5-d589-465f-b33a-05303399e798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755184, "uuid": "2530fd7b-0ea2-4a93-a624-d3557942456d", "value": "doc030WA0004-55YH701-75IMG0012.p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07911a8-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767477, "uuid": "7fa86953-5551-4190-b2b9-caafbd7f294d", "comment": "Malware payload (Nitro)", "value": "a83bb7c2ed1856a8873d25922cc8f2e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767477, "uuid": "8c247fe0-e4a3-4087-9041-25c8be046573", "comment": "Malware payload (Nitro)", "value": "631e88915214ef5224dbb4931f41f818ebf222a3fe9e165fb9e1d9397b6c5e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767477, "uuid": "91bd353a-c7e3-4fc1-b46b-88a96d877496", "comment": "Malware payload (Nitro)", "value": "eee21c531d58f7bf630f36b4b27f21ec210ca033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767477, "uuid": "63c22247-6fc2-46e9-8b27-ffc43beb799a", "comment": "Malware payload (Nitro)", "value": "81832429fff6ef397840560c1225f4675ccabe2cdcf6c10e5bb3e7cdb2bdcb08e927a943c0098f837473ae77a99f4d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767477, "uuid": "0a0ce341-4ec6-4bfb-9356-ad46da6f6167", "value": "T1645365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767477, "uuid": "0ff58883-3695-41dc-bac4-a50faf20741c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767477, "uuid": "1ac8fb90-44e3-4de0-abaf-c005a0d62247", "value": "768:yOucKn7n1JGDNANIU0xvLDwUzc80gmq3oP/oDk:yO2GDNAPer/0O8/ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767477, "uuid": "a64a7dcf-7544-4782-8650-74cfe45dfe4e", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767477, "uuid": "00b6c096-c878-4ed7-bb3e-b0ced13d1f08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767477, "uuid": "13bca9df-b4b2-4672-a779-d13aad2ec0b9", "value": "a83bb7c2ed1856a8873d25922cc8f2e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f66dc0-fb3a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628751272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751272, "uuid": "91ff65e1-f6ac-4938-b06c-6829c26d0c7e", "comment": "Malware payload (AgentTesla)", "value": "761052a7a58747a3bf71830b289b180b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751272, "uuid": "1ba26f3a-1431-4ef3-b87a-22ffc5ed98ad", "comment": "Malware payload (AgentTesla)", "value": "638a54444450f755043099f36b6c3d143e18557ccd328b73b3d1ef988353b5f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751272, "uuid": "f4c17f52-bbfa-44e4-810d-091bc1558c74", "comment": "Malware payload (AgentTesla)", "value": "d219aa48f50f7185fba051c1ca246468c328fbff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751272, "uuid": "c238b5ca-ffb4-4936-98ad-d7b06256cc96", "comment": "Malware payload (AgentTesla)", "value": "bb3a6079844a6297888f96ea60970400158cf4d97e38458d64b9d9d58a0cb3b8bff7dc4cf62f7ee2bb1fcfbdf628bf75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751272, "uuid": "1a49bf22-2798-4ca4-8168-c0d3bcbef46a", "value": "T13C05D09C329472EFD427CA72DE642C64EAA178B7531BC207901315ADDE1E98BDF106F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751272, "uuid": "cf3ed54f-60c7-4bea-8dc7-8e8a8674660d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751272, "uuid": "720acf94-d592-4266-a734-5a3518360a42", "value": "12288:zPyc6VXpg/HK7zq6Bhln4WcFEABWcWx42nPcfl2SWxeSGtF102VUx+NiUD0CfwJJ:zPyc6VXp3Fnl4WcSOWNPcf8xqNq+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628751272, "uuid": "1503d054-e53b-4733-8f50-a54bcfde26bc", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628751272, "uuid": "3a662e64-a4bc-4862-ba03-ba04267f9cc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751272, "uuid": "c51e7cf0-8342-4498-9d46-9714051b7ad2", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3168bd4b-fb0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628732823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628732823, "uuid": "808c58e7-ca1b-4879-81a5-5a4e4cbc413d", "comment": "Malware payload (Loki)", "value": "28b53af06040db7a67d790aa26cbf6c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628732823, "uuid": "bae9912d-a163-47ac-b454-88a117024650", "comment": "Malware payload (Loki)", "value": "6438095080694e51e7802ba419e9854234dccdd3cc818eee26cea88f6391177f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628732823, "uuid": "c88c1654-eff5-4fe5-8850-186e0e414739", "comment": "Malware payload (Loki)", "value": "c71dd623b41f15baa041ad4e4e5c8b77b6b65030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628732823, "uuid": "85caad1b-ee33-443a-a8b0-616163463b6d", "comment": "Malware payload (Loki)", "value": "d29f6670dfb4ef0f2f005df0250dfc12773188a8d09bbef53aac782ca9659e2e49bee2094be5b07dd6efa22a3b733bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628732823, "uuid": "19f9940e-140e-46ac-919c-7e49242e3b01", "value": "T13654F151F9E5A277C172083ADC6499926B3AEC708F3F5D77339A011A4E209C2ED34B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628732823, "uuid": "fb33f48b-05e1-4f10-aa30-223f1d4d609c", "value": "70dc986f89100eba5b0fbf299e1d4ebf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628732823, "uuid": "bc9ebf23-dd8c-4cff-9eba-f7627dc92b33", "value": "6144:Q+l/lR8NG2JNUDwxTIxr36LOGZCCCdlEv1BX8NdJF92WvC61:Q+l/lmGUNUDwVIV5i8EvrX85zrvF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628732823, "uuid": "cadacaa2-7072-455c-aa0d-f7c12ee0e15a", "value": 302606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628732823, "uuid": "4867c9c1-9ca6-4c83-9d9c-4ce7ae18b93b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628732823, "uuid": "4774886d-4ee6-40a1-ac64-d09d41fd845d", "value": "Agency Appointment for Proforma- Da RV-201-00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7b3f0b-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628738323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738323, "uuid": "3cdaef56-7457-44d1-942b-161f4e557667", "comment": "Malware payload (Gafgyt)", "value": "c5641e0c3d0d27f3ab77d28cbdbda1a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738323, "uuid": "e392c539-c4cf-47ed-acf3-7fd285759e10", "comment": "Malware payload (Gafgyt)", "value": "649ee31da5e928a7ff846102d1d9713908e4d11ddbdbcf79348304ce7584ad46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738323, "uuid": "5c26dea2-5872-4378-8dfa-37a22c0b8eae", "comment": "Malware payload (Gafgyt)", "value": "ee4955d756bf62ba0b2b5c9dba0a4de0d6764c15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738323, "uuid": "2a0a3c9d-592f-4f78-abf0-c3c0fe4d4720", "comment": "Malware payload (Gafgyt)", "value": "06c015829a68db4696c62438a58a188ea772782e64e0702c5e4047ef3d51da90e847cfb101b5e2651beab99e6bfcc588", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738323, "uuid": "1d4179a1-750b-4bfb-b79c-9b623ecd23db", "value": "T15FE33B09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738323, "uuid": "94e4428f-548f-4ed6-a64e-1c4626505950", "value": "3072:Bn7aKpF4LSV9OdAKoxHcennFEM/9OD4bxCkEFvmpwfvRQfZn:l7aKpF4eVZKo5cenneM/9uvmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738323, "uuid": "4263501b-18eb-475d-ad35-cfb0b6be9ece", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738323, "uuid": "ce54e06d-8eb7-49fe-ba65-1c141b4a4c98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738323, "uuid": "71ee2c03-6aa7-4f7b-8d50-1ea89c8f9f51", "value": "c5641e0c3d0d27f3ab77d28cbdbda1a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fec272-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628767565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767565, "uuid": "8e2f8a80-142d-44c1-9bfc-c577eeacae21", "comment": "Malware payload", "value": "c02af314620221216500289914767e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767565, "uuid": "95c1cd57-75e6-4d66-a804-54fc09bccd59", "comment": "Malware payload", "value": "64e7c5f9e1317765db32c99a975aafbfd32388720f480f60170fcff711c05cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767565, "uuid": "b1bb748c-dc00-4c82-b043-ef3ca704a92b", "comment": "Malware payload", "value": "2260a6d794ea20f66e36212c13f724436fe6f2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767565, "uuid": "8fb13786-5d3e-49cf-a24b-3c03de56a401", "comment": "Malware payload", "value": "779528a72603974435ba95dc22ad7ee781422c3cf341264653c8af21ed559ad356891da301bee3d6b77b8e4aae58f3d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767565, "uuid": "9b010a44-8fe0-47be-b79e-ddf8f035bfc1", "value": "T1DD041205B6F7ED3FF7A884B29A2BC3495B3BB1361200C593F98473659A6A38C04325D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767565, "uuid": "ff1891af-ea9c-47a5-8d8c-f81fc908668f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767565, "uuid": "afe152d8-2e7d-4014-963a-0d55cc9f034f", "value": "3072:fi+h0fc/H2/98ja3p0I9jQL+PLSusMl6KdPP/2W9+Bb3XpxmkLg4/JuUnl:fuUv2Oja3p0ojQkQFKZH2W9+BbH+qJuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767565, "uuid": "23f39b02-3bd1-4d13-a583-3235e4fc7bf5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767565, "uuid": "d366333c-55a0-4366-ac35-e14adf9443e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767565, "uuid": "572f69a4-e7ae-411a-bd1d-452ada940143", "value": "c02af314620221216500289914767e88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714fee1f-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767720, "uuid": "3b369519-cd3a-4e32-9233-b20ae682acac", "comment": "Malware payload (Nitro)", "value": "ecb5faaf15a75e66857d0cdfe936c45e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767720, "uuid": "81b947a6-fdb2-4c55-a3fd-3bf190e83abc", "comment": "Malware payload (Nitro)", "value": "6546f0638160cb590b4ead2401fb55d48e10b2ee1808ff0354fff52c9e2f62bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767720, "uuid": "f538acfa-665a-45c4-98bc-5800f6096aaa", "comment": "Malware payload (Nitro)", "value": "2a6b69c095963a76b29b78509d58f586a5c0ee68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767720, "uuid": "eb56c83f-6147-4146-b1d0-e1e32d07dad3", "comment": "Malware payload (Nitro)", "value": "9db4d3c2d36dde2363535d3fd97201dbb8e56980c12e78dbd6b82054c099408370a41082ac3e1df4c0406f2cbc6349be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767720, "uuid": "a76db41b-f332-46af-b578-db17a71bdceb", "value": "T1EB53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767720, "uuid": "5dbfc91b-969c-4777-95dd-a187a7a94e62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767720, "uuid": "abd5740c-6ca2-49ac-a23d-9d9a23f9a0f8", "value": "768:wKsMqCXfVcWMHM9ZkiANIUZBOYLDwUzc80gmq3oP/oDe:wKse0M9ZkiAPZ9r/0O8/oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767720, "uuid": "2f559443-164c-4b69-a8d7-8bf834beb61a", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767720, "uuid": "33f64204-f8ae-4989-913a-b13b9a90d976", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767720, "uuid": "1160f80b-c13c-4c0a-8097-449c65bd2a94", "value": "ecb5faaf15a75e66857d0cdfe936c45e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9cbb42-fb4a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1628758313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628758313, "uuid": "6fb42150-35a4-4f9d-9692-5b65dd2c8123", "comment": "Malware payload (DiamondFox)", "value": "e51038570d307a474c11dad48a5503c2", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628758313, "uuid": "ff326601-4d16-4ee3-a805-60efa0c10e08", "comment": "Malware payload (DiamondFox)", "value": "65624215e9613e4922c32eb184b75ea1334a6a2fa32d45ef535918ef7b9a9eca", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628758313, "uuid": "b624d240-81b2-4a83-b22f-a1c01bc608a7", "comment": "Malware payload (DiamondFox)", "value": "ad6d23e0da5e05cac857111ce376d8cf6b46930a", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628758313, "uuid": "420c3c15-a375-4e3d-b6de-a4567020daf5", "comment": "Malware payload (DiamondFox)", "value": "6490d2be4c150d381ab09aeb63326de32bf9c100c102a8048f632f16e13745d8881cda7f70e1432f15b8353f219e2a23", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628758313, "uuid": "35e34cd1-973f-489e-b287-954f0df93d78", "value": "T1892633107B8481F9F9132031DA842BBE6A6CCB9116395CD73B52C18E5B3FD93E62B91D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628758313, "uuid": "dc7ee8ec-2e96-473f-949a-e42d9101e937", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628758313, "uuid": "19fe6523-0a3b-41d8-8ccf-68107c1bedeb", "value": "98304:xmCvLUBsgyLBZwCOMWjybulF9e+9SYQKYQddJopOQAj1xS:xPLUCgyt2CP2F97QsJoUrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628758313, "uuid": "529eca95-a1d3-4c41-8058-35ffbdea1164", "value": 4558907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628758313, "uuid": "d849418b-6c96-4f54-b88f-6a933934b8e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628758313, "uuid": "e45ce85a-8211-4b27-a3e1-a26c422d8d94", "value": "E51038570D307A474C11DAD48A5503C2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a457395-fb6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628772352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772352, "uuid": "7f8505b5-e705-401e-b8e0-cf3c2b13abc1", "comment": "Malware payload (AgentTesla)", "value": "5dc064393ff064a805b21a365e46a52f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772352, "uuid": "5b6271f6-ffa7-46ab-9c76-8d1a28ce3dbc", "comment": "Malware payload (AgentTesla)", "value": "65fe959342a7c88c36544aa993a10af1a90576549e97628d2c442f639f60132a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772352, "uuid": "da92749e-4009-414d-be7a-1b10d3a755d7", "comment": "Malware payload (AgentTesla)", "value": "ea6816cc643c1469ec5449dcce961b157dd689c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772352, "uuid": "4f60935c-d241-48ba-9630-5016e2160640", "comment": "Malware payload (AgentTesla)", "value": "3132330392d1caac90963b1b355f7859c14aad3997332819323b2a1712102355b3bc99d5c4f00861c2635a717b668888", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772352, "uuid": "ac52da97-e075-482c-abca-1fc35b63d60c", "value": "T17865C43C29BA2627D07AC375CBE59827F4509CAF3151BD94A4CB73660376A5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772352, "uuid": "76d3476b-4418-4d84-96b8-02950f5c13d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772352, "uuid": "2c4a215f-afd2-4f32-8aac-d96336769247", "value": "12288:v0wer/Xk9UfHbRpGDbZIjK3MGkF2XzfyJpJLeC9AT2fXKk/HmUVpmldEVRC7:vder/Uqf7RwDbp35kFS8Py7T2fXKvOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628772352, "uuid": "4b897e94-1a1d-4f2e-9bae-a72c545d5e2a", "value": 1429504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628772352, "uuid": "66653244-adde-40c7-a0d5-cc3ef6b77b17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772352, "uuid": "a979fb90-234f-443d-a458-e3b83657b3de", "value": "SCAN tt copy $18,300 AUGUST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c798149-fb49-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628757672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757672, "uuid": "7b1678a6-ea9e-4387-add2-f88a7513eaa7", "comment": "Malware payload (NanoCore)", "value": "864e2a02a8da7f5829616b793608b6a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757672, "uuid": "a5bbd115-ee34-455a-93c7-ee15d7097ee3", "comment": "Malware payload (NanoCore)", "value": "67617f95de4c19d97e4de6934d2b29e02625853fe80a205ff4086c8bb32cd4ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757672, "uuid": "c49b9f2a-6e4d-4d37-8edb-4d3502d4a640", "comment": "Malware payload (NanoCore)", "value": "619a1d84a874f2698f44345d49cd02a205cac6a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757672, "uuid": "64b3aee0-f79d-477f-b54a-c1eea1f23fc8", "comment": "Malware payload (NanoCore)", "value": "554a5e78fc9162e996a6fa94f4db3e0a18699b316ac70f1814a082def11e7ced172d9f954708e9896405368d87d7cd30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757672, "uuid": "c1f4743e-4c28-4ad6-8ebe-de326ef7201a", "value": "T10665E53C29B92627D1B6D375CBE59827F4509CAF3161BD94A4CA73260372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757672, "uuid": "be711f93-82ee-4e3e-8b12-8c0667d5e95b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757672, "uuid": "bdaf0196-7bb2-43df-a6f9-7e2a26c0bd54", "value": "24576:0YbZ4tp4AmnemleGlp7BQrH93T2fXKvOc:VbqppxKlp9Md3T2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757672, "uuid": "36528162-0862-4ff4-8479-40785f7f3fa9", "value": 1497600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757672, "uuid": "d47beaf2-962a-4788-b5ee-557dffca866b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757672, "uuid": "8b799bdb-b261-4932-b6f8-499004b28657", "value": "864e2a02a8da7f5829616b793608b6a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74f0910-fb91-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628788856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628788856, "uuid": "b928f512-c47d-464c-8ab7-cc7369fc4e66", "comment": "Malware payload", "value": "ae939f0c6b6308a2480c6bfed9584b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628788856, "uuid": "bc1376e6-fac0-47aa-bde2-3fd9335638cc", "comment": "Malware payload", "value": "676ad42f30fdf1bbe21bed26c20c364de77711339d1d04aef22da6d9fbc83f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628788856, "uuid": "21457b4f-4bbb-4ee6-a2f3-b90a19e41d74", "comment": "Malware payload", "value": "7ce037d124d0c5a315c1002482c16b1916958f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628788856, "uuid": "bcdc96b9-c743-489a-ba12-dc86244062ed", "comment": "Malware payload", "value": "79c31f57ca3fd72f33fad397b54c20b3e4ea3be3f2cee454a33469bbe8fcc8447e4ebcbb0678aef0f9fd1e7f5484b1eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628788856, "uuid": "e019ab6d-446c-489e-b46c-5122cfe84427", "value": "T10B143B177A8A2DFDE167D277CA839346D6B370B40321431E23686EDA4D8B3946E1F352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628788856, "uuid": "1fad4ac0-1abd-4678-bdb1-3ec73f77e934", "value": "3072:Sp//ilNzbO8QxMpVTke5gPWNO+PwrrXzrto1MSOnUtDaqrVNbWu1ATQpeum4u1ij:JNHf6UMqr6ZUp1m4RSl4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628788856, "uuid": "ce27c4b0-ea30-49ae-af08-6b17465d70ce", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628788856, "uuid": "283356cd-6955-42d5-a11e-2af45b002b8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628788856, "uuid": "0a52cbea-3302-462d-be25-e7781e1d611b", "value": "676ad42f30fdf1bbe21bed26c20c364de77711339d1d04aef22da6d9fbc83f96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf56736-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628750341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750341, "uuid": "d0344d39-880d-4203-ae55-36e8dabb0c7b", "comment": "Malware payload (Formbook)", "value": "81285772ca6597218d42e3c301ec38c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750341, "uuid": "35615400-3f18-424f-927a-1824c79aa9be", "comment": "Malware payload (Formbook)", "value": "681986a550ac1bba8275516742b4589a7069f823e1b9902df466831d043e6a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750341, "uuid": "7b19bc67-ef69-4e3f-a74d-a73addc3ea92", "comment": "Malware payload (Formbook)", "value": "75f8d57a46a7390d7a7004c93ad006192e5c748b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750341, "uuid": "59634d11-bf6b-4aee-864e-47444bf05e4c", "comment": "Malware payload (Formbook)", "value": "fd231e8a7daf7445b4950fcec065321dad367fa1df5096e1cdb674472ff9c9764e187607dcfcc2644acbaf41dcedc808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750341, "uuid": "7db35f67-1a10-47e0-8358-9b735a1c6aa9", "value": "T10465C43C29B92627D0B6D775CBE59827F4509CAF3161BD94A4CA73260372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750341, "uuid": "ebcfe8c1-5c21-4f51-917f-64e5fb260066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750341, "uuid": "5d17f408-6bce-4f51-94ce-b56c39fa832d", "value": "24576:nBt9siOEQMIBC1cmti+VEupmGBqT2fXyvOi:OevIrGbyDT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750341, "uuid": "410648df-e62b-4962-bd73-7c76bd56b656", "value": 1432064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750341, "uuid": "ac1ba854-b0f0-4f65-bc18-6702e10c4eec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750341, "uuid": "20c2a9bf-670a-4b3d-8167-2a39bfcd8f4e", "value": "81285772ca6597218d42e3c301ec38c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d17da4-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766954, "uuid": "58463fdc-65d1-4943-a26e-25b431105575", "comment": "Malware payload (Nitro)", "value": "6b879402d63bac69c46b94df675b6450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766954, "uuid": "53ae0e48-fb67-43b6-93b8-bab5cbf82ab0", "comment": "Malware payload (Nitro)", "value": "692f4b8fa6c7ae480d9962dc946a6543f64e7c47ba4f873b5ff709c1a45883a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766954, "uuid": "f1c3e6ce-6401-46a9-875e-47062a113af7", "comment": "Malware payload (Nitro)", "value": "39f22aa273609bd1a69d0992bf0bc4a94d7f7695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766954, "uuid": "2e1ca171-5b16-4f51-81fe-b329dd14a67a", "comment": "Malware payload (Nitro)", "value": "0ad7bc8419e2abcf48b172015494049d7473cd35a0913f2ace68eb4a2d57094b072c639bff7b9090737d33535dcee017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766954, "uuid": "6bf104a1-a9a8-4535-89be-7e6e8163510d", "value": "T108E3F7693377952AC03E4A7414F32A3A67B09FA714A0878D55E2D3693F323B24A11FDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766954, "uuid": "f058baae-a846-4c81-8e60-e8eba5e2f957", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766954, "uuid": "72f4977d-ff53-4ede-aa8f-fff72fa0efb8", "value": "3072:YHLulWk9GD2M+Lra/Yt8/oQvWXLl8IPKmg8k0/P3awOdPeYPiePfGDCmGmePdIZ6:mk9rM+SQCXvWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766954, "uuid": "ee1943c2-94e9-4911-9352-42b5fd27b135", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766954, "uuid": "d01dab47-c5bc-450e-b2fd-53e37dd741ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766954, "uuid": "fa22a4cd-c424-4250-b0be-f4e3ba252280", "value": "6b879402d63bac69c46b94df675b6450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb9fe48-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766826, "uuid": "f1cf3422-1c7a-4027-a55f-78d9bbcb4bf3", "comment": "Malware payload (Nitro)", "value": "1c0f67a41d332b5a25dce142db622fcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766826, "uuid": "57ae1fea-d307-436a-91e6-4668c1bff6a3", "comment": "Malware payload (Nitro)", "value": "694e04416190cfe151344c58d06fbf91ee8c32776d1c1a7d21576598c0419bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766826, "uuid": "64539437-0850-4be7-9793-0ddd83ea5b40", "comment": "Malware payload (Nitro)", "value": "272c1640269bbc59c29a49bbb678a06f3d40c0d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766826, "uuid": "be783782-cc0b-4447-97fa-0d8c1471dab7", "comment": "Malware payload (Nitro)", "value": "3f583b88e910d96fbf0c41841105b37e49934f0e03d4f0d820271c1a1a9c3b473401c8ea2fc03a01284aee1205f44c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766826, "uuid": "e22d8fe6-9b53-4a2e-ae79-7452c0c8c956", "value": "T1A45365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766826, "uuid": "ad189ebf-7437-4e8d-a3c6-b7e07222c8dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766826, "uuid": "7f998f34-b525-4b78-a79f-dc5ae19573c6", "value": "768:aOucKn7n1JpDNANIUL2vLDwUzc80gmq3oP/oDR:aO2pDNAPor/0O8/oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766826, "uuid": "ab83cb61-af1a-46d7-b04a-1835d59f4eb2", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766826, "uuid": "cd58332c-e14d-4cc9-9c42-6ad9db69645f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766826, "uuid": "bca2cc26-d705-4608-9988-afd171d0da60", "value": "1c0f67a41d332b5a25dce142db622fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2136857a-fb33-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628748258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748258, "uuid": "b9232a2e-08f2-413c-b5ad-67ac73fc450a", "comment": "Malware payload", "value": "3216915af63fad5e69132a0db8e2e27d", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748258, "uuid": "275cd854-c0ed-4849-ba7d-5f258cd7c7da", "comment": "Malware payload", "value": "6ac5e34d6c4e0218370b529e43e9548c8ecf5b7412a1cee5a2b8afecccb06c1e", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748258, "uuid": "0d10642f-271e-4a76-ac0f-4acb0d7ebd56", "comment": "Malware payload", "value": "8d107aa7320c20b1bbbceeb7c1ea34a9a20fdcda", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748258, "uuid": "1017e113-870a-4beb-af2d-7efdf415a43f", "comment": "Malware payload", "value": "5eea224a6aac1b29fbcb9f0ced5d0393a1d9949bf8f3a611aa9845b626d407931ca2e9b84f76825fdc010ccc85b573ce", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748258, "uuid": "1ae8cd1b-bb36-4d3f-b77f-63f12d485693", "value": "T1A7729E2DE741AA79C360947EC00B31D7A28D70984955DA4A2A52711CBFC2AF70BDF3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748258, "uuid": "b7864204-a145-4aba-8d8a-ebabddbbcbf0", "value": "384:UWef3TBPJ2cNPrqVJJr/cUpj9xN7Q3jNKZEXcYIdA2+9:PevTBPbPCF/cUpLN03M+VIa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748258, "uuid": "8b696f07-b565-4b07-a406-0c6f2948f7af", "value": 16536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748258, "uuid": "f4bf7eb7-b10f-4c47-9856-97cfc650649c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748258, "uuid": "547140cf-771b-4648-909a-e9c9dfe5e448", "value": "Payment Confirmation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1e14c6-fb25-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628742582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742582, "uuid": "62454d35-f4aa-432e-bd66-01bb868588a8", "comment": "Malware payload (Gafgyt)", "value": "7a98182775318df06ba0bde04e6795e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742582, "uuid": "6bda07fa-790f-48c8-a347-3d8c1bbd827d", "comment": "Malware payload (Gafgyt)", "value": "6bb9bf5bb345b5fe7adc971ff85954e26c59b4e9945960dadb465b545a9a1054", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742582, "uuid": "4fe7d600-da1b-4621-9ab0-9f931fc92fdd", "comment": "Malware payload (Gafgyt)", "value": "631a9541b6450f759cd7ca5ea21fc5006f064d20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742582, "uuid": "5533e73e-a1da-4e01-9daa-086be5861168", "comment": "Malware payload (Gafgyt)", "value": "e6521ba43c720f35be713533df0b00e1c7fd577ce4fda12d26a977ddb1420fc8387cbeb7b3d220429ba2e7fbaeeee0cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742582, "uuid": "b541ed09-96c8-42cc-8e7b-8afcdf8fe744", "value": "T13C33FA43A9A69F77C086AEB526B30A740753F8154F1B0B8A712DBDF4474B9CCBD1A360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742582, "uuid": "126877a6-2d81-4dfe-9ca2-4a19bc8c6151", "value": "768:+8CfHJIxKeKz7ztaXoU0GQR86SZdf+G2KCUI2ZhF/EkghEj:+NvJI3Kz7zAYU0n8uGfCUjZvRbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628742582, "uuid": "ba107d90-9784-4550-aa04-909d6bc94a3e", "value": 50986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628742582, "uuid": "25d004e2-ac7a-4d70-a2d0-1120b339192a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742582, "uuid": "ce3dad41-6dad-4cd1-b417-89a51d4a0336", "value": "7a98182775318df06ba0bde04e6795e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72a41b0-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628776427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776427, "uuid": "f7213467-3cef-4450-82c0-475c541eb040", "comment": "Malware payload (RedLineStealer)", "value": "11a6b62f22e247e2a6fcf5d15e42c830", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776427, "uuid": "b20a53b2-de0e-4e59-bbec-442ee17c252e", "comment": "Malware payload (RedLineStealer)", "value": "6bf5f4826e8a08a51efd8c251af36a1730d57487a0e598dbd74b6fbe8a11d7ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776427, "uuid": "2ec63fea-4aab-436c-9c21-5e9049ddc8ef", "comment": "Malware payload (RedLineStealer)", "value": "b969e27e4570d309397d47baabb266b2ab1eed04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776427, "uuid": "8f01925e-0761-4d86-b10c-e9a6637f8e04", "comment": "Malware payload (RedLineStealer)", "value": "58537e1ac1a44b1fbe2bde471dc3b1af13c643f64a4a2700bef7b0384ad9276160652e3156edd6bc45e3ea60225e92c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776427, "uuid": "aa4602ab-2b6c-4300-a7c3-0186222ae7a5", "value": "T1CA069FD63787E3DFDDA91AB8F1168D878138E3E267204505EEE8FCBC4A82E112587745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776427, "uuid": "f6dfe877-1e31-433a-af9e-a0540e138bbd", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776427, "uuid": "eb3dc98c-dc8f-4f06-b93f-e43ae11c0a5d", "value": "49152:ZaY/cQwkAIl1yGpWDFYR0naO/RIaVj3mdoh:ZbcQl+Gy2R0aO/RHj3md0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776427, "uuid": "a6335bf5-1762-4bd9-bb64-a4ac7d99732a", "value": 4012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776427, "uuid": "ef247d67-a42c-44ff-a8a8-015e8c9d7266", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776427, "uuid": "956e447b-3b5f-402e-a12e-d0eab1ea2e88", "value": "11a6b62f22e247e2a6fcf5d15e42c830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0faaba75-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628776146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776146, "uuid": "c951e2da-aba1-4a48-97b3-b9f5827d90a6", "comment": "Malware payload (TrickBot)", "value": "97d0ff826db4708c0bf8bff513dda02a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776146, "uuid": "2ae3af31-f08c-436a-9f78-80a3b67a4996", "comment": "Malware payload (TrickBot)", "value": "6c238a124150dc1298bd6a347e8628b51ca2d5ae04b0181270a5928aedc63ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776146, "uuid": "a1e73d79-64ad-47c4-a814-f4c642fba76f", "comment": "Malware payload (TrickBot)", "value": "b281f8da746da72039c98312c2f51cb806613ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776146, "uuid": "fbbf51f9-1ec4-4fc7-86d3-80509582409d", "comment": "Malware payload (TrickBot)", "value": "8c5ec9d4799e9f4376d913f42525b9c53c43219243ad6762f9bf26adfc739d7f070888beed479e9e04109879b8690b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776146, "uuid": "ed2ede3f-bdf7-4f61-bae1-1017e84bd265", "value": "T1C115CF5235B08037C6B25A714E2A2B2DBAFAFD684B7394C363884B5C5971DD11F3633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776146, "uuid": "0db35628-1383-420c-a9f6-288509486234", "value": "a36b8c98f8710737441ff391a1167b41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776146, "uuid": "640b724b-db30-4977-a8c2-33c47407fe31", "value": "12288:ZUKFfy62YznW7A+YTr+PoIIxOeCW33pKAvsrvl5a0R5w5f:1y62YTW7A+PIgO3dviTa0ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776146, "uuid": "12c1a6b5-305f-4bc5-9b9d-fc5bd9e6d20a", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776146, "uuid": "8f3d4aa6-dac2-40c8-89bd-7d100a1f3c2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776146, "uuid": "ac29db17-4b4e-4280-8e68-bb4b81ede1f4", "value": "97d0ff826db4708c0bf8bff513dda02a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9cafbe-fb6a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628771926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771926, "uuid": "0e382d55-4a43-4d8c-acc3-b675a44eebaf", "comment": "Malware payload (Formbook)", "value": "190bbbb3ef3a08fc73a9d397f87de2ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771926, "uuid": "bf1abb91-12da-4fb1-9db2-570e8632815f", "comment": "Malware payload (Formbook)", "value": "6ce6f6c16310e90a3d624750f1d7146aa4d2e8baa04d409133869199d4a5d23a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771926, "uuid": "8d3fb585-88ed-43ba-b611-aca340c643af", "comment": "Malware payload (Formbook)", "value": "c81ffe08d0c6b7859d5c668fc8a756c8acb0b451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771926, "uuid": "377ee637-d6ed-4e73-a646-401021959494", "comment": "Malware payload (Formbook)", "value": "70dc45e03fb9f28a6f5ffa366be1f878bab739f02b6fec19ce0b90bb3f7748df4e7fcaf61d085f07f0215dc25133dc89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771926, "uuid": "647e1bdf-7626-426c-abe4-ed69d4beeb73", "value": "T1C7755C3D19B92637C0A5C6758AE18817F0449CAF31D1A9BC94C27F66C3F6A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771926, "uuid": "35fd8c80-fee5-4866-ab21-2dca068bbd44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771926, "uuid": "a1fc44f6-f185-4957-9529-b0ef02f1c0b5", "value": "12288:v+q3bFCO9bHBa3AWZavABd0YItKOxZsSbWQdOm//8xLrQ6H+Uy1Susr8MmH3j5:R19bHBiHj6cOxvbWQd9/EFMZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771926, "uuid": "5d337315-6978-4ccc-bc31-a76eb1f9c3b6", "value": 1583104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771926, "uuid": "6eb5ef67-e7e9-4985-b6c4-4f46dc31af56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771926, "uuid": "6403d68c-28e8-41f1-8fb8-e33cc1fbb00b", "value": "List of Item Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16e5b8c-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738675, "uuid": "3125e5db-9391-4a31-a573-fdc38418aa6c", "comment": "Malware payload (Mirai)", "value": "6c6959728af955d046f72a556bc390cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738675, "uuid": "0f16d487-e656-406e-a0c3-3b4814944a42", "comment": "Malware payload (Mirai)", "value": "6d25250517260dff7e02eed2c7dc5341eb61cc62f9d01c6737fca00c2daf9145", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738675, "uuid": "ab082d4b-7f8d-4ac8-b2a0-3657c3652d6c", "comment": "Malware payload (Mirai)", "value": "1abc795a9b497a0e6f41b504a1149d8856d1c772", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738675, "uuid": "a2673bc5-b5fb-497c-b243-af491d688399", "comment": "Malware payload (Mirai)", "value": "b19dbfbc1cc8fbff7d008ed60e1238a5c5145eb0b85b062a98cf4ad44f9ea94136a02d05c4ac02d6be2b842be8b7a1b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738675, "uuid": "fb6e619e-d127-493d-aacb-b70b8cbcd321", "value": "T104A35B82D643C2F3C4430AF1029F965A0532FB3A8A3B9EAAF75C7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738675, "uuid": "20780bd6-0cde-4bc7-a047-9f7087ca0536", "value": "3072:uLOqjPQP39VjGWX98732V7kGyNVM5huTQ7FXnf0OzTyoQQub:uJQP39VjGWXW9NVM5huCFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738675, "uuid": "b7a5d92d-632e-4fa7-b8c1-0a6076b324e2", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738675, "uuid": "28772398-9b42-4e1c-83a1-1b841a2e3d95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738675, "uuid": "2ad26753-5683-4cc0-8c16-dc27aaf8e215", "value": "6c6959728af955d046f72a556bc390cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db00ac8-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628775901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775901, "uuid": "2309ab41-8cad-4e3f-a395-b6b8219cc9ac", "comment": "Malware payload (Formbook)", "value": "6ca8cdb0d06d2ec82d087806fd42b042", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775901, "uuid": "a75fd3b0-480f-4c16-b257-37c06b6c8d1f", "comment": "Malware payload (Formbook)", "value": "6e200bfb5b8cb8805a46f3385ca28f70ede622b6b358424dabdc8db066b8f29c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775901, "uuid": "95bffd23-3e89-474f-8bef-6eab3ea0bdf7", "comment": "Malware payload (Formbook)", "value": "52e84a6a8d39e8985ea772ed2004da655c89c085", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775901, "uuid": "070e477c-5295-402d-bda9-2772fd8f4287", "comment": "Malware payload (Formbook)", "value": "d28fd817c1198c36f434f544b5774dc7e206c95d9ef52f7df28793628c4d47b7762a467f6581804ddf03c81cf624a499", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775901, "uuid": "614414df-3fa2-4a81-b123-dca428158fd4", "value": "T1404512D8DF9AAE01FF325E7020E9505294E89C1E315A657A32CBB39912773266BC331D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775901, "uuid": "30a19671-88c2-4e71-9355-0005a909b4ff", "value": "24576:jTTTTTTTTTTTTTTTTTTTTTTTTTTTTFTTTTTTTTTTTTTTTTTTTTTTTTTTTETTTTTn:7GIoRrgUO1rE4dQo72Q/D3J7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775901, "uuid": "2214ed58-793e-4a21-9521-eca6f2250316", "value": 1239208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775901, "uuid": "c5f54c3b-ea02-4f5b-bee3-64f9abb69e29", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775901, "uuid": "131cd2bb-08d2-4b36-b569-5d514f8ebaa2", "value": "New Order Faruechoc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfc67b5-fb01-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628726751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726751, "uuid": "8b964b4e-29c9-4e2b-b628-9ce46248106e", "comment": "Malware payload (Mirai)", "value": "0cfc2f8f6a5bcdd19a85b5d3b35b522f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726751, "uuid": "8e0710fe-254d-4edd-901f-7c6bffdc8023", "comment": "Malware payload (Mirai)", "value": "6f023328ab6a7a654dd03984b3df4492295ccbf02c2fcbdc53103780b325f508", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726751, "uuid": "85dafb24-eeb3-40ce-a9db-e2e433ce993b", "comment": "Malware payload (Mirai)", "value": "da680525fe61b546497ae9b0ff59953c58d8ff9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726751, "uuid": "428093a8-0391-4320-ba0a-bfa8b1c4d08c", "comment": "Malware payload (Mirai)", "value": "2ac00c04e068dd63c60f05b01b6b63d5dde391ab1c18ef46a20b80302d677c088e1c0a0833bdd72572ba372fdb541f23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726751, "uuid": "ca260f27-9366-479c-bfc6-4dfbbf76f43a", "value": "T145534BC0B643E9F5DE020674306BEF324E36F6F6211AE987E3E4D673AC425419543A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726751, "uuid": "4b9b7ebb-548d-490c-83d2-7197b456d8e2", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKUm+eTWoTnt05XFEiRh:1jSwY4keBfrtOCQsnnF1uTNh0513R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628726751, "uuid": "5fa6c1f5-0c9c-4a5e-be6b-83e0c2d843f2", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628726751, "uuid": "70c82e65-9972-443d-9eb5-3fd7c05a45af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726751, "uuid": "f537bd99-a3d3-48e8-adde-ca31ee32fb28", "value": "0cfc2f8f6a5bcdd19a85b5d3b35b522f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da72e14e-fb47-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628757159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757159, "uuid": "1bbfae10-8f69-4421-813f-ec21554a5045", "comment": "Malware payload (AgentTesla)", "value": "7fe448068fe5724fb72e04ab4fe0bd4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757159, "uuid": "77090222-5f00-4359-baa2-495b4ca485d1", "comment": "Malware payload (AgentTesla)", "value": "6f874e77cf3c830caffd8965d38d7ec5bd55a1a67fdbae24687a244f9a7fd2eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757159, "uuid": "b5dd8595-3316-4a8f-9df1-7717a62a2427", "comment": "Malware payload (AgentTesla)", "value": "1987b857330bad5ea203d6104337b11622bd5ec1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757159, "uuid": "00922954-e674-40d5-852a-eebd68906e15", "comment": "Malware payload (AgentTesla)", "value": "cd6f65fda049167242b0f9f5f65c2bd32bb5e60d2780110a1c819d7fab62f3371d47b8ee26a2cffb18ba798a4a6ffeab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757159, "uuid": "2dc41635-8f28-4c52-a54b-9f048eaedc9b", "value": "T12A64F1C2B3E6D132D0B90A3295E888B6961DF9704B6F4977778C112B5F702C14A35F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757159, "uuid": "34752bf7-28c3-4540-9a11-c536ea4dd49c", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757159, "uuid": "6634f83c-fb3f-43dc-a78a-b3f3bb82fcd3", "value": "6144:aeERiOnee4TgAkXP4lCF6EPm6tZ/s+E5NPmB9/EyYD77bU:aeER0e40AqP4lC4gTc5NmIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757159, "uuid": "3ea011b4-34a9-4d5d-a7b5-d57760209643", "value": 307163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757159, "uuid": "d7dced6b-34ea-4269-a7c0-8d7fdda9369b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757159, "uuid": "640743e7-827e-4cb0-aa21-eaf78db7fc58", "value": "7fe448068fe5724fb72e04ab4fe0bd4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b7ab0a-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767536, "uuid": "f9120480-e318-4caf-95a3-a4db25c70b09", "comment": "Malware payload (Nitro)", "value": "bc11fc2a90a7a421d0bd7019dc3110ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767536, "uuid": "6fea6b23-9582-4514-8700-f7df4e9c25c9", "comment": "Malware payload (Nitro)", "value": "7008ae96755d552b01144718f9095a48f10160f2cb4d672e043d5de3528a271e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767536, "uuid": "6a6b9edf-baa0-4aa1-883b-05a447536b35", "comment": "Malware payload (Nitro)", "value": "a9ac39e4b7ae65ec263f94737b4b4dd212da709a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767536, "uuid": "d5fe660c-d61c-4d38-bea0-cb2fb6d8c3ce", "comment": "Malware payload (Nitro)", "value": "73a901d23ad78358c2cf89e1f73160522bcb585656dd7ce7c3eb35dd03694b1d8fd292cf721cdc0a0b09e8dbd9009f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767536, "uuid": "217d90ad-d2aa-43ca-b29c-e89ebe922a03", "value": "T16A53542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767536, "uuid": "7e2b2ae1-8d87-4a31-b523-9b86be34b214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767536, "uuid": "75aabb22-c61f-45ba-b154-c3ddad36bee5", "value": "768:8KsMqCXfVcWfeM9ZkiANIUX1YLDwUzc80gmq3oP/oD/:8Kse2M9ZkiAP6r/0O8/oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767536, "uuid": "0e8f08b5-19e6-4a58-81b2-98f2ed0f1caf", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767536, "uuid": "76db6829-dad1-4bf0-af56-798c579fb8f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767536, "uuid": "c783ebdb-d8af-4821-a116-316b36ab1be0", "value": "bc11fc2a90a7a421d0bd7019dc3110ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf86f81-fb1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737673, "uuid": "62ec21cc-f671-4f3e-8d67-27ab6b2b1edc", "comment": "Malware payload (Mirai)", "value": "4b0eaeb46d90bae8c3d90aa17fdaf8fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737673, "uuid": "0480e288-28cc-40c8-9bde-7e8d867548ff", "comment": "Malware payload (Mirai)", "value": "70ebc49b609fb97008014f0a3d6f4eb85bbbe7ad0577b5a288ca5a6adfe4b402", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737673, "uuid": "7a3779e4-f956-4f55-baf3-a3dde6122f13", "comment": "Malware payload (Mirai)", "value": "dc276c93b742139d1ee2e6933441f46b3e02c062", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737673, "uuid": "2bcaa85b-2460-4b15-8117-3893ab64ff86", "comment": "Malware payload (Mirai)", "value": "5c7091fa50b9dd7b880c6bc9ff79a951ac24329bb99b2c7f88be65df8dbe8744729fe0a2b5df0d32f2e85c3da8911c21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737673, "uuid": "ae1ff74e-21fd-45f7-95af-048a55b4e9eb", "value": "T1D5C30805FC404B27C7E23BBAF79E438D773666586BD733116A295EB02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737673, "uuid": "175e4d47-f007-420c-b7c3-1c0b0a85f07c", "value": "3072:0JDZ+6lJQTnoo3AK5nnyXxfWG5hLFCuXUSP4eoC9DQlD6ObAF5R:7nyBuG5hLFCuVhoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737673, "uuid": "13350422-8989-4945-89e5-85bf31b1f583", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737673, "uuid": "054ed481-7758-4d7a-9b7f-af805a6c4b72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737673, "uuid": "4e6fc815-1750-441e-bf57-4b75a8950b9d", "value": "4b0eaeb46d90bae8c3d90aa17fdaf8fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7063cfc3-fb5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628765571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765571, "uuid": "18dbe177-ace2-4c97-932e-630bdcb17bb2", "comment": "Malware payload (AgentTesla)", "value": "e5b3fc8e7c159b836046b6f657179929", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765571, "uuid": "010403ff-439d-42f2-b866-81cc34087ec5", "comment": "Malware payload (AgentTesla)", "value": "73cefc887f0ab4d9e0269c527c1687e360493926bfb7ccc3a876b4bb19832b85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765571, "uuid": "e3bf57e1-37e0-44bd-a9f0-a4d5b646c839", "comment": "Malware payload (AgentTesla)", "value": "90a8ebb6a71a7b8462cfbf5ff7605bc66297c48e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765571, "uuid": "e3ba04a7-d218-4ce3-8fde-3cac49cf4a5e", "comment": "Malware payload (AgentTesla)", "value": "6c0a7c68daee51f7e219621e7319cfdf80ee406257b00b5872591ff61de6c400b2c0047f204f7e9362914c938f89f650", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765571, "uuid": "aa830117-4cdb-4c0f-ae6e-40e2177a712e", "value": "T152B4121369200B67E1F51B7489EB860072330D49D37BA48F394DFAAB7773320861E6E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765571, "uuid": "ee8b7fc9-9ab0-4c5d-ab03-d3feb7761205", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765571, "uuid": "915e7899-9b3c-4b23-80b8-565015424669", "value": "6144:pqpaDiyDFrvC2uEXmoKpiTQfmlrnKdjkt1V3e+VEdC0cRm7+7nT3wJHWv2EvkWbm:pTDBNKEvKMnKdQPVxEdFcs1Ji7bTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628765571, "uuid": "d3cdcba8-1f68-4411-8961-7b8a4ad1a4f8", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628765571, "uuid": "349e355c-dfe8-4e31-8f41-7bba0f68ee48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765571, "uuid": "e1107a79-1fc8-4e70-a06f-d73066323ec0", "value": "MANISA SILVANA - Spec.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440f1763-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767214, "uuid": "bb16f1bc-32f7-48d1-ac95-b7b5a1791b04", "comment": "Malware payload (Nitro)", "value": "92eea22c70cf0fe4116b1021e91eb373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767214, "uuid": "b8f8c430-c7dd-4b8b-b5ec-be5b4d572f0d", "comment": "Malware payload (Nitro)", "value": "73d55d99c41e89daa8c9bd213d02974d89b53c3e5a0dcd5bbf0b99ff36424cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767214, "uuid": "6e6cafe7-1f3f-4f0e-8d1e-7b79cb6d99ca", "comment": "Malware payload (Nitro)", "value": "66b8c24be3b82ecbbebb5e5a70ddf746d212e16f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767214, "uuid": "45b3c6bf-00ec-4fa8-81a5-3929b4d38e56", "comment": "Malware payload (Nitro)", "value": "4b614fed350461d700ac80c3a5730a0574bee4b270b307cc9d2ab5270775f50d69c81d4cda53cf5be5611f8344c00245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767214, "uuid": "b83b31f4-2bb4-4fd5-b8e7-04f4f2d5c613", "value": "T11353542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767214, "uuid": "9aa33e58-51f7-4dff-a03f-1df45b725c4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767214, "uuid": "9763e480-b6b8-4520-9ba1-dca9373c2edd", "value": "768:HKsMqCXfVcWO/M9ZkiANIUM+2YLDwUzc80gmq3oP/oDH:HKseiM9ZkiAPhr/0O8/oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767214, "uuid": "f420b6cf-3b48-4ab1-8f8f-78b4d589fe92", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767214, "uuid": "876c1e74-c0e7-4ca6-976d-cd4422a8f216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767214, "uuid": "2c884619-94a7-4511-989d-71acc0ec962a", "value": "92eea22c70cf0fe4116b1021e91eb373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1826d2c-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767371, "uuid": "12adb80f-0b15-4c6a-81a2-61db11ba7ab2", "comment": "Malware payload (Nitro)", "value": "45034f735a3787eb9f2d19a94438ce6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767371, "uuid": "a53981f0-9fcb-4f69-ad47-0785253eee13", "comment": "Malware payload (Nitro)", "value": "74c17cd974cea94e1d1852938e9806583aa59dfe6f1f856198dff82aac1f7468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767371, "uuid": "b80f5393-d017-488b-a03c-9106b8a259a2", "comment": "Malware payload (Nitro)", "value": "f9c4dd44d59e365378845a4d58dfa76a74e57d93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767371, "uuid": "82dac317-0a95-42da-b0c0-19a4b96f1608", "comment": "Malware payload (Nitro)", "value": "2f7d3364a39862b951325b60dac6c1303e5467db109f73dc2ba3763a019416b85635dd62ded7cd91eba6ecf61e9f712b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767371, "uuid": "358b5f71-9b9f-4958-a468-3c61053d7025", "value": "T1F253542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767371, "uuid": "3bafba7b-7c09-438e-bda8-2424261f6b49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767371, "uuid": "e4a62b4a-c738-464b-823a-113eaf941ed0", "value": "768:dKsMqCXfVcWubM9ZkiANIUouYLDwUzc80gmq3oP/oDo:dKse2M9ZkiAPIr/0O8/o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767371, "uuid": "85eb66bd-d471-4bfa-8b08-e1bbf170b3cb", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767371, "uuid": "d241ca3c-98dd-4674-9d37-f6f3cfe08ba2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767371, "uuid": "dd951835-c415-4dc4-b4d6-b6a0cc96a41c", "value": "45034f735a3787eb9f2d19a94438ce6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526eedde-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1628750488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750488, "uuid": "e2db6b43-d0e3-4a18-972a-d1484fddf3f1", "comment": "Malware payload (KPOTStealer)", "value": "55c995af76779a98d3813bb1498d2533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750488, "uuid": "40036b18-e515-48a1-864d-48b1efdae68f", "comment": "Malware payload (KPOTStealer)", "value": "74e82ea63f25fdb065ab8d4df1d69f9a22d1c1a76edf609f2f22d5080411fe4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750488, "uuid": "926920b9-412c-4095-917f-855438ffa5c7", "comment": "Malware payload (KPOTStealer)", "value": "61549859c1a945787ac05fc6b609a1529a84ad47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750488, "uuid": "69c54919-2872-40ab-94ab-c0cb8a076c09", "comment": "Malware payload (KPOTStealer)", "value": "346ba26d2c5b080e4d888f09300d68a6e5a6d151a3c572f16b0005a8f7dfdae6f1a96b462de1752d475d2d41cee1f982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750488, "uuid": "1e691b44-5d6d-4787-9914-8efd4b86a361", "value": "T1F794F1517C7DE872C48145304066CBF05E6FAC60BD6510CB7B993B6FEE603E6627A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750488, "uuid": "24638778-9e94-4995-800d-2d3aa4065e66", "value": "5ba12e6852ba82499f5822056a147515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750488, "uuid": "0ab91fff-11ce-4e25-9448-783710b2436f", "value": "6144:EwyXu95ZNKNEOiaK9/4iTQdwLPWL0ElMflxkc3i7knGyHM:EwouGN3kJTUwa18v3iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750488, "uuid": "a24f6740-bea8-4a6e-bd33-3b2dfe38afa8", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750488, "uuid": "52c5322f-0e65-4c19-a714-7c042012da73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750488, "uuid": "7bbac55a-11f8-4247-83f8-11596fdd2d6e", "value": "55c995af76779a98d3813bb1498d2533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c330e891-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628738651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738651, "uuid": "1d952241-3cfa-4a43-94d3-73067c3c6811", "comment": "Malware payload (Gafgyt)", "value": "31cc1a978351397152828da81d343608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738651, "uuid": "395cdf8c-9637-4cbe-84f1-2cb9264eff02", "comment": "Malware payload (Gafgyt)", "value": "772177f88be61c0ed205060ce52aff11babd4ff3ecb31be83935ccfc67ae921b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738651, "uuid": "ba56ce30-c363-450d-98c6-4eb44538d6b8", "comment": "Malware payload (Gafgyt)", "value": "70487a6494460eb8a3810fc317e01c78e67b17b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738651, "uuid": "08918604-481c-4862-ad77-5f62b93e7b44", "comment": "Malware payload (Gafgyt)", "value": "541db118605a57fd638d135020f1bff6aa289838058903e930440515b543b490b48ae2c42fedb962e0707034834f7138", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738651, "uuid": "76814606-8d98-42aa-baa8-3db63337a76f", "value": "T188930892B900DFB6F40ED77A08D34724B670FBA24E531672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738651, "uuid": "19e1e32f-cc2b-4abc-bd29-575ed6424ede", "value": "1536:4wZuvNTV8V9eEG8ktQmzn5h8Jn9/QT60ydwgMT2fDhXTmQ9VqXjewf2Le:B0T49m8KT8RQT60ydw9+RmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738651, "uuid": "e8d4f1c2-d4ff-45f8-86bb-ed6e9b500bc0", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738651, "uuid": "eba74518-5099-48f3-b95d-ea9b432740eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738651, "uuid": "37e0e39a-d84f-4b59-ba95-39dc1ccae268", "value": "31cc1a978351397152828da81d343608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d87946-fb4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628759698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759698, "uuid": "73358c28-755d-46f6-80be-839427750879", "comment": "Malware payload", "value": "67091d9b8c087ecb9115ca88aeb77884", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759698, "uuid": "c85c5c5f-5a6f-4696-be51-e493d15752d4", "comment": "Malware payload", "value": "776fb24822beb4ee5ecb5d715081f0b3efa6d99cb6f7748bcefd3e382e3fdd68", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759698, "uuid": "916ebd99-767d-4fdf-80f3-6187038bddfd", "comment": "Malware payload", "value": "ceba0b7351702c9978f4b7e072235ab0530e5159", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759698, "uuid": "a5f94172-2a7d-441a-bd36-9591457fbfcb", "comment": "Malware payload", "value": "79d0b761415b5eb06931a5ddd1442a3aba547636015381e44e7ff128168b763b25a05e74f1d72413ef92483d6e30cb2a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759698, "uuid": "50e764c0-04cb-49e6-a945-2848a7133a95", "value": "T1BFE50206FB997C5FE9B7483116AA83266651CDC1C70ACA03CB28B26CBCB75C15D9E5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759698, "uuid": "3b570e5b-6487-4b86-9e5c-d9abf0928837", "value": "24576:/vwSe7+PD6MmYCIs7LKl+92zBRvPPmm6SiVPhMaRYijnzxFg2AWzym:/M7M6Me7Lq+92zfvPnfahNRXrzHg2A2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628759698, "uuid": "2a6101f1-3049-49be-ae21-c5493998caad", "value": 3100397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628759698, "uuid": "d32c4442-d751-42b7-aa0e-91f4f52e426c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759698, "uuid": "94b7cc59-e934-4633-8d06-851f802f55c0", "value": "ceba0b7351702c9978f4b7e072235ab0530e5159.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e6a0f6-fb48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1628757453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757453, "uuid": "e33abc64-ef09-4f66-9e3a-8d9320994069", "comment": "Malware payload (Hydra)", "value": "8421a95ea4edfe3a06cb6c78db58848b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757453, "uuid": "5d5a47c4-d964-454d-82ab-0e3173e8e7ee", "comment": "Malware payload (Hydra)", "value": "77b51738442f4d1b388db76db05388bd358b19f21c1f663e7993f9e32a7d6278", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757453, "uuid": "d7a5e9d2-6345-4fac-ac83-3cfe4f0eee45", "comment": "Malware payload (Hydra)", "value": "7b31ba4b4b2b5971ddbc812689c8ac28f28bd2a8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757453, "uuid": "8f693d65-7404-4ce7-afea-1f8a383a26ce", "comment": "Malware payload (Hydra)", "value": "92b7a2d6e8679870df7a5bc65ebfa3033d1456a43fd297950806721d41b835768ce8caeb562af8b243a9ad21740f1e75", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757453, "uuid": "73978b68-c9ad-43a5-8d86-5ebd761b3546", "value": "T1D6E53307EDA1930BDA57CA7140844AADD111B7633D93DA0F2E256E207CF5EED2323DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757453, "uuid": "722b47d8-4b14-41cd-818d-83588a341657", "value": "49152:v+afhiOsnVv0VdZNg6ieo3jGkIuFMEh4X64AKdA90Y3xnb5n5UgQCVSHn:vdf9aVv0Vd7rmXIWRj90WFusV0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757453, "uuid": "fd2a7d0b-bfaa-49ee-ac0d-db3b71074b72", "value": 3115783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757453, "uuid": "67333b33-9681-4494-bb9b-b1baa9e2541f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757453, "uuid": "462f49d9-6f14-4a3e-bfa1-77ba5953601e", "value": "52431_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8f1651-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628738315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738315, "uuid": "8cbcd45c-4f0a-4c05-99aa-49ac73ea2e97", "comment": "Malware payload (Gafgyt)", "value": "1796e388adb6d96e4b6b2756a278357a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738315, "uuid": "f1bacbde-4289-4ab0-8bc5-ddddb6391163", "comment": "Malware payload (Gafgyt)", "value": "78150fbca1c5f53d67c9b1d6d3c1d95753df307a181aae4a22d20f89cebf7deb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738315, "uuid": "934d3a16-195b-49fd-90d6-4bbd5a26707c", "comment": "Malware payload (Gafgyt)", "value": "354d7a31c0df694dd43b124afd58d231a2199e6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738315, "uuid": "805aea3c-0975-4c5a-971d-d63716da03b3", "comment": "Malware payload (Gafgyt)", "value": "b03d1d7f1ab971c73afe51841c0f34e9ad1d5b9c2c1232aa7cd14c98d4f04622e0d5bfc3756b2b74d6121f19b42adea2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738315, "uuid": "f86a1fda-dbc1-4cfe-a006-df5e7aea367c", "value": "T148B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738315, "uuid": "54fcc970-4646-4856-bf62-bdee78eed4f0", "value": "1536:ZLeTGkthhSMOCMQS+ZjN4pjuIxreg2Oit2eDo/LUmkiSFxfC7xbXe:Z5HC3S+dUreTtTDCLUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738315, "uuid": "7d4f8b1b-1cb3-4776-b8e8-59bfdeb9441c", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738315, "uuid": "1e7b3882-add9-4b11-a600-ec11b0cadbda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738315, "uuid": "d033c8e5-499d-4613-8e6d-29024d6dc767", "value": "1796e388adb6d96e4b6b2756a278357a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368d7c0a-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750012, "uuid": "c0c906c2-8b9e-4e69-806b-1c9d0a0d07fc", "comment": "Malware payload", "value": "960be496f560db3854738a3a600447b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750012, "uuid": "5c978c06-0520-466f-95a9-b1577955f48d", "comment": "Malware payload", "value": "786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750012, "uuid": "0e4fe118-7df4-492c-bb94-dfd84de88850", "comment": "Malware payload", "value": "7eb04a30b29918a5de1607c0b59cbcdb4bcddded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750012, "uuid": "1d87abea-8853-4ae3-b5de-86540ec0a9a4", "comment": "Malware payload", "value": "aaa6dec40690926a9ad543f996bad3e300e9b98e7beca5e7f518f398c3a6a7f3ddfb63e61463d5b29a144065360493a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750012, "uuid": "242785a1-eb3e-491c-bde0-cad0d7601986", "value": "T19CB4D030BA90C031F5F702FC55BA937C662C7A719B3450DB92E92AEE52346F4AD31687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750012, "uuid": "df4f1571-df93-42aa-9181-eef0cc091c99", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750012, "uuid": "22566689-303e-4bb2-9fdf-eeb8e0759c35", "value": "12288:cQX6XoKk2QZOcS1co7I/wJFTxXwtLVQ4AINzy:3K4KkRO7YwGt4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750012, "uuid": "77c08bff-2701-4f25-b039-0bef86c02c35", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750012, "uuid": "784ae21b-7729-4a53-8fc6-8928455d2df2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750012, "uuid": "e25a19c6-c3cf-419b-8dee-e4474d198cc6", "value": "960be496f560db3854738a3a600447b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8450d777-fb33-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628748424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748424, "uuid": "457739ed-5433-4779-962d-4198e6ce3cc6", "comment": "Malware payload (AgentTesla)", "value": "e68267754a46d40fc4e09e7033cd0408", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748424, "uuid": "3ae3bdc5-6aaf-48c9-a463-b83c5efac78a", "comment": "Malware payload (AgentTesla)", "value": "78ecf7e2f54fe91840736aa4a84124f23cafee63526aacce2e86a4a644287de2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748424, "uuid": "dceee931-fee2-47c6-81ba-9aac69cdf9b0", "comment": "Malware payload (AgentTesla)", "value": "5acb0bdbe52517231ee37a63cb98ac3c464c6165", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748424, "uuid": "8b5f5225-79ac-4d28-a3a0-aa9532b71355", "comment": "Malware payload (AgentTesla)", "value": "5ef68f39537627eb95c81d89043ae78833ed3c347a96695cc2cd63f020f1b7353090b087303d2a6cf77bc60bf707dede", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748424, "uuid": "3d8af434-39d0-43d9-aedc-f5eabc85f81d", "value": "T1A1979DAD765072DFC817CD72CA681C64EAA0B47B930BD243A01315AD9E0E99BDF245F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748424, "uuid": "4712569d-7f38-4c50-9592-3ce5e7eaa16b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748424, "uuid": "50b450c1-e517-4c36-9c10-136968d97394", "value": "12288:EwGQj/HK7zvvCkaIIw2lUJG78EjDXZYu6ZgHLv0PIop3cWekWf1g8qcn+Y+dQM5b:1KjCkrIw0UJNEjDXZnsgrvyPVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748424, "uuid": "46386184-28a4-475b-9df9-50d9ec968f78", "value": 39845888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748424, "uuid": "c7064406-00b0-43a8-8a94-240664a3c330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748424, "uuid": "858e2060-7df7-4752-a0dd-6b8a172aaddb", "value": "Banamex__Pago_07768843.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8410fe82-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749283, "uuid": "61688f63-8951-4808-87c1-cd22d2a11060", "comment": "Malware payload (AgentTesla)", "value": "de63e5df2d9432c0d764bc221839e07a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749283, "uuid": "11aa952a-7461-4d9e-9053-3f78212287b4", "comment": "Malware payload (AgentTesla)", "value": "7a6fdabd72549331e0dc08d06a4adadaa7c37761767a6efc53b249fcfd278444", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749283, "uuid": "6f8c525d-4951-4348-9adc-0e2b313b3fad", "comment": "Malware payload (AgentTesla)", "value": "dba744ed3679cedd9fad14458a40994d9f786000", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749283, "uuid": "7ed7dd0c-b71b-43a8-b5af-3615650c265e", "comment": "Malware payload (AgentTesla)", "value": "98f07db60aa071df9be91e6daea23e1ec679bff791c43d7b8aee27c48c9d0fd22c5088c53090ceb21411ebd38b075439", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749283, "uuid": "24c99fa5-f916-40cf-904b-f3384013cb93", "value": "T12F65C43C29B9262BD07AD775CBE59827F4409CAF3151BD94A4CA73260376B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749283, "uuid": "386c8852-dafe-4c58-a1b4-220441097e45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749283, "uuid": "c3e02c4c-1279-431a-87a8-65f1936f591d", "value": "24576:trUJ+ih2bAKmPgZteQX7eqf9vT2fX6vOi:CJB8bAPo6Qreqf9vT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749283, "uuid": "2b4447b1-39cf-4de2-a298-0ca0e3046c7c", "value": 1428992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749283, "uuid": "362e9372-0f05-4fe5-952e-b9e07717149b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749283, "uuid": "1facd81d-9a5f-49bf-b8e0-4b88ffc147e1", "value": "6b1mK8pGDjFiOSp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27987f5-fb29-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628744260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744260, "uuid": "ef5bf34a-61cf-49f4-a238-a21f9f403af0", "comment": "Malware payload", "value": "1ab68861cbb539af250899445e168233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744260, "uuid": "ab49f3a9-8422-4bf1-9117-41f458161687", "comment": "Malware payload", "value": "7b05d46b12945a754e07915535b5c977078818b088ce5de1a31ff40b3c2bef61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744260, "uuid": "73276d42-9137-4c5d-8efe-bc490203c46e", "comment": "Malware payload", "value": "e4299a99e197c034b76f9415acb599c810f4f659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744260, "uuid": "ee2eb428-9e29-4f03-b5cf-69d0f4fabccc", "comment": "Malware payload", "value": "066edddf3e6f4be6f0cfad86009cae2a9ba8b743cd5f89419629a9685e4ceac70ae376911e81970ff1264effc131bd7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744260, "uuid": "2e07f4ac-2e8b-475d-84bc-f6e619d45a31", "value": "T13945E156F7CBFAB0E6FE827A85F1852C56B774620260E74F664072886D22392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744260, "uuid": "8c849678-19b8-4cb8-a22e-3ddf875258ce", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744260, "uuid": "586d47c1-1e25-491c-8727-02d494205662", "value": "24576:DzbGHAzHKjX1rBY4ZyrE7K3yl8PeVooA/AB2LEgpUqY/CL+elRtA3k0yy3l4VzCa:DziHILpUhxel6k0yyW094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628744260, "uuid": "997f8a51-9e2e-4f56-a573-898662aebfcb", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628744260, "uuid": "f24d3609-df20-4223-925a-458e87316515", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744260, "uuid": "df7f942a-1e25-4afc-9107-3eeabcb4b7a9", "value": "Payment Receipt and pending invoices.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e23979-fb6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1628772720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772720, "uuid": "644329e8-8896-4789-9c0d-3f98e952f92b", "comment": "Malware payload (CobaltStrike)", "value": "24d24c349b322096938ba2f5adb7a0ab", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772720, "uuid": "7f7f64cd-0e5d-4550-9392-8d03ba4a9b44", "comment": "Malware payload (CobaltStrike)", "value": "7b2bb3a9b505b92b22502466ec2f3ba21f27a5264e85587ccac913c9260bbba9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772720, "uuid": "65f5baf3-35dc-42f9-9598-f2ffdce7c33e", "comment": "Malware payload (CobaltStrike)", "value": "821aa5d01453cfddb39a4220b532e95223d45554", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772720, "uuid": "dfe9309a-3bfc-4c78-a32c-bf07deeb24c7", "comment": "Malware payload (CobaltStrike)", "value": "0ab148402dc834f20676e5b986acc003c251bf85527e0475120ed940826dd3422a87307e0712dd045c89eebf3738d9e4", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772720, "uuid": "1ecbdfaf-c32d-4992-9b6c-2526878fd060", "value": "T12D253801ACEB44B2E682AB331DF352DF6731E20C0771B9C3EE544B75BA06AE95532365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772720, "uuid": "82ece530-2933-4d9a-8c80-b813afdca1d5", "value": "59db241a514f19be04cc47bd80c44884", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772720, "uuid": "4f8f07d6-8be4-42b4-a33c-56766539dfdf", "value": "12288:LvBex88QmpNtCwKEJWavKcOXb2wrDS596OOvN5GfvI1sbafVHWwjYoFCh6+daat:zBeG0pNtCJWWayP9rC6HG/Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628772720, "uuid": "d7021011-f0ed-47e9-8e98-fcede42ffc01", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628772720, "uuid": "ff1be16b-63e6-4980-ae41-dedcc45a6c47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772720, "uuid": "9315f69c-773c-4c02-8569-db828bb55540", "value": "7b2bb3a9b505b92b22502466ec2f3ba21f27a5264e85587ccac913c9260bbba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0e5b77-fb3a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628751637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751637, "uuid": "7edae929-a98a-4433-85ea-125e662f2ebe", "comment": "Malware payload (RaccoonStealer)", "value": "2b9103addd66f83517888b11249dc44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751637, "uuid": "f9cec980-aa0a-49f6-b6fc-2ffce2dd46d9", "comment": "Malware payload (RaccoonStealer)", "value": "7b5c65ae580d887398957fdeb574f54427e5dccdd0ab8cb7a9e6f91074e28b17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751637, "uuid": "5d45cb4f-928d-4345-a87b-54524a6b20f6", "comment": "Malware payload (RaccoonStealer)", "value": "92a0fd9ae55be9eb1af2b8d5c7b55cf43899f0e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628751637, "uuid": "b311288b-8b72-4370-ba25-8309ba493da2", "comment": "Malware payload (RaccoonStealer)", "value": "d2964f772a755bbd3056cb0a9aec93633d4e6c65d6c7dd1a6ba886d3c8ac3b1595df1aac83c17821cca5b586af39ea34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751637, "uuid": "1bcfd5ae-ceb6-4083-9b0d-0e654db6c8a6", "value": "T18AC4D031BB90C031F4F602F845BA93B8A52D7EA1973450CF92D62BEA57346E5AD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751637, "uuid": "e529776d-fe70-43d0-be0a-033c7327aeac", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751637, "uuid": "11596a05-6ee4-436e-a6cb-ea9a86c6e610", "value": "12288:Aw0BXaqyCBubFFEcc48v0h5MkrbJoXrPRom433Aod72yzg4y:70KqyNtL5MkrVo7Jod3Aod5zg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628751637, "uuid": "bc4f984f-cb39-44a2-bcb5-572274183a1f", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628751637, "uuid": "fef1c288-aecd-4f21-94c5-93124778f766", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628751637, "uuid": "21d8aa0f-8c35-4317-94a4-2764c6cbfb56", "value": "2b9103addd66f83517888b11249dc44d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021e738d-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ZLoader)", "timestamp": 1628776123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776123, "uuid": "195a735e-c2ec-448d-a647-3ac85bb44e5b", "comment": "Malware payload (ZLoader)", "value": "42a3e6ae86fe540cfc106f4edc55eccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776123, "uuid": "b2ecced2-19ab-4a75-9e75-b83512f55928", "comment": "Malware payload (ZLoader)", "value": "7ba99f8f77a2e660f1837cad9d169ccf892154da5b2651e4e6e66efddd61944c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776123, "uuid": "bc048e79-c589-4c33-9041-6795739c5f3d", "comment": "Malware payload (ZLoader)", "value": "5a43baf8b4e0150ad0228a13da2000311f36f823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776123, "uuid": "9dafc54b-0741-4869-943d-10291dc3de80", "comment": "Malware payload (ZLoader)", "value": "2f335c874ceadd6298bb78afdee3b7fbf8d9dd814fb36cfd510c212688c84f18c7ccaaf55af94e9f5030157ae85e5f61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776123, "uuid": "3555287b-90b7-4c11-b550-3b2d4188512c", "value": "T128F37C0F63F86066E4B5937459F202D35A327C615B3882EF128E997E1E336E0B631B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776123, "uuid": "816a1fdb-4440-4f88-8818-eed45dbd3285", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776123, "uuid": "d79ffb3a-492c-4fdb-80da-4e7246a36e05", "value": "3072:kahKyd2n31f5GWp1icKAArDZz4N9GhbkrNEkb/3rO:kahODp0yN90QEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776123, "uuid": "dd00c103-d434-4165-9384-c2efe306c03b", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776123, "uuid": "0e139ffe-4d3c-4130-8cb7-d6f2855b84cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776123, "uuid": "bf2fd1b0-0ff3-44dc-9216-34cc0bdc9393", "value": "42a3e6ae86fe540cfc106f4edc55eccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5e1068-fb47-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628756897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756897, "uuid": "5b7a64b5-482c-4f9a-8f80-440c9cacc3d0", "comment": "Malware payload (AgentTesla)", "value": "e8a5202307ec44163bee29d5f0d806fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756897, "uuid": "cf519def-e289-46f4-bbf9-e030ea03a78a", "comment": "Malware payload (AgentTesla)", "value": "7bc995cd61b3a6dcf917ff0ed3ed541f8f80c597636b8dcfacbf6128c659fc14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756897, "uuid": "e67acfb8-acc3-4bc0-b968-88b4e3a2e728", "comment": "Malware payload (AgentTesla)", "value": "9536cb3646195c7e2dfc5d8217aae1e77141e962", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756897, "uuid": "fb002147-cef3-4ddf-aa3a-cd3f069a12dc", "comment": "Malware payload (AgentTesla)", "value": "aed92f581fde9ff59a022848aada8c24ee91d83c13c386c01b6ec0a2e1b968a0bfa74c9d166c4b809becd4fae617f8fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756897, "uuid": "8c1b92e3-463e-43bc-a793-ddd6f9e6aefe", "value": "T11764E151B2C9C964F9772E3014A9C8A28B2BEA301F6FE97B734853261F740D1D931E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756897, "uuid": "5a89ae7d-2b5c-46d4-b4b7-498eb46463b7", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756897, "uuid": "e44e4386-e274-440b-9e8c-2ceaff0258ae", "value": "6144:Xs9rRiOnKVLvYNRRNLHbJoSnPZOCyF0dfs0QtQm6sT/A97vsM:Xs9rRRNx7lnkCL5GT/A9zsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756897, "uuid": "cb4433cd-b06d-42fe-b2e1-d2b4cf67a195", "value": 306954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756897, "uuid": "226ce176-4071-43a5-896a-5944b0e7fc85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756897, "uuid": "d97bb496-e6ad-4b6a-9c8c-87c5f7c6700e", "value": "e8a5202307ec44163bee29d5f0d806fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb5b334-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1628750510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750510, "uuid": "ee06b27f-5f6b-4efd-9ad9-9c6781780f56", "comment": "Malware payload (GuLoader)", "value": "85ef4d2c4d482b353c237e1145fc52bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750510, "uuid": "3ef63002-2ebe-47bf-8dd2-9e16cc5ae337", "comment": "Malware payload (GuLoader)", "value": "7c113db245bdcc7da302e5c36e7c340e8467dc91cb9576a3ffb479575ad21b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750510, "uuid": "314aa086-def7-42df-b565-62355af46b1d", "comment": "Malware payload (GuLoader)", "value": "ce8e66d056a7093e5d89c0249d713a5a00084b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750510, "uuid": "4613befd-3851-41b5-a567-735c96d77ff8", "comment": "Malware payload (GuLoader)", "value": "7c3a5d1cecf7cc0cdeec4539b61abb606ae1ae34647266e63a92de66b14835a750ea489b3be652a002c4d4c10fd364bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750510, "uuid": "da7b4849-70f4-4ae1-bfb3-d6e42f11f2d3", "value": "T127344A3273A4A53ED867CB717BB191B64C643C3755E8505EFA103A8207B2AD03C69AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750510, "uuid": "4d4afa6b-58fb-4195-82b2-9a85415ca538", "value": "6b2c11cfb39c06809475cfa1f065a769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750510, "uuid": "2cb8bde1-cf29-4aee-973a-80aa53d5884c", "value": "1536:zrdTtOCRO0YOWAMyCAOzcbQ9jt+TWiUb69pZBsAYDyB7jV+q3hs1+o:fxtfRYyNOzcbmSi+ZB8DyB7sZko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750510, "uuid": "ab54e693-bb52-492c-b44d-2350906084b5", "value": 230712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750510, "uuid": "050a5710-e69f-4acc-bc5c-1ce5996267c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750510, "uuid": "484053de-8dd9-46c7-a0e5-6ef92a4077fd", "value": "85ef4d2c4d482b353c237e1145fc52bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81b488e-fb53-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628762362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762362, "uuid": "14f43b00-45e3-4240-935f-84afdb8e7cb3", "comment": "Malware payload (AgentTesla)", "value": "0582de6b5ffc3f6a0ddab7af133d09aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762362, "uuid": "042ce374-b329-40a3-8e97-fa485e890813", "comment": "Malware payload (AgentTesla)", "value": "7c2a1cd4698642e67d5c4240c34940196be56850086c52d049a10204a81f6eac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762362, "uuid": "2a3762ce-78a0-4907-bc76-c25ca8a59230", "comment": "Malware payload (AgentTesla)", "value": "9e4299a9b8ead6660dde477f5ff4fe4b37be3272", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762362, "uuid": "9387da5d-65d3-4e86-b224-270ef681c8f9", "comment": "Malware payload (AgentTesla)", "value": "e9434667f0367a07121b001ea6759dcc73e2bcbc0324d4769874e1c94bc91b47c03e8d6c3a7b8980870184d25efebf8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762362, "uuid": "2c4a4676-66d6-4333-9adf-49a3e0f4ee03", "value": "T14F755C3D19B92637C0A5C6758AE18817F0409CAF31D1A9BC94D67F66C3F2A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762362, "uuid": "51cd26e8-a65d-4068-b179-b486e5a817e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762362, "uuid": "63e82991-1bf1-45fd-a41a-0f46d3af2ea8", "value": "12288:qqFjSXhEEbWmmjhD7sMaavsZTrEtyqD6wCXFzfmCGIPQ6H+Uy1Susr8MmH3jY:jSEEbWmmNsXGE4tyqD8XRfyIoZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628762362, "uuid": "e24557f6-e3f9-4519-9b54-b6d12481705d", "value": 1565696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628762362, "uuid": "75a53414-e20e-47de-819c-0bcc2870111d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762362, "uuid": "beb3205b-adb0-44a1-adb6-5fb4877bf3ce", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a7d557-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628776132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776132, "uuid": "d17f370c-66ca-4111-a8f4-7a20a417fdd2", "comment": "Malware payload", "value": "f33f31622720595a736e72c5996d48a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776132, "uuid": "f517c7a3-2ff5-41b3-b886-19c2285ca58b", "comment": "Malware payload", "value": "7c329bd7a397d952ab8aaf8dce4505803377944f17d5d7fd39e29d196b7bcec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776132, "uuid": "da612d1f-d225-4640-a542-5c0ae04fac2a", "comment": "Malware payload", "value": "bfda661d9db11133ce359e432c7f150cb1c57c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776132, "uuid": "29bfb9d2-157a-4b8b-8305-da3a50c0170a", "comment": "Malware payload", "value": "68e5ad348408f167bb5dd134db7d285c372141e940148a92cb97ceb0c5a1e06ce9c2b1ee761cdd8714039171d690cd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776132, "uuid": "ead1e737-b5d1-4ca1-ad96-a0def367b772", "value": "T173447C30BA90C034F5BB12F845BA937CAA2C3A615B3450CF52E51AFE56346E5EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776132, "uuid": "ef2a6e9a-8254-4cc2-ba13-d988fad7feb0", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776132, "uuid": "8cfbae0d-2116-4d43-b544-bfe624863695", "value": "6144:ekRwtxxvZVcau/Yo1vwX7ttw+GcUJS1P2iiGraKFxPPf:ZwtnXcacXWX7ttKc+StTiD4xPPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776132, "uuid": "4f1fa564-ea61-4c13-8130-422acdffe5ab", "value": 269059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776132, "uuid": "a0cfff71-a74b-448b-8301-72ce9cd67d91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776132, "uuid": "8d9e9b5d-bf86-44f3-9ea0-c607214bb02c", "value": "f33f31622720595a736e72c5996d48a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076c4433-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628750362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750362, "uuid": "830635b9-1d8e-4b1c-9df0-a821e0fd77ae", "comment": "Malware payload (Smoke Loader)", "value": "148305697d92d61210ae5edba017d0d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750362, "uuid": "f8391040-a17c-48a3-8153-82c60057bc1c", "comment": "Malware payload (Smoke Loader)", "value": "7cbb426664a725717ac6d2f9d87e025330689e24a7091d0841abaecd982ee1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750362, "uuid": "c382158c-a6df-4ed8-ada6-22242b937ef6", "comment": "Malware payload (Smoke Loader)", "value": "bf194c9614561236f854e05b3207a19049038896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750362, "uuid": "b20e00d7-46be-47ce-a50f-8148436bf23f", "comment": "Malware payload (Smoke Loader)", "value": "1f1d136b910e859486490628a230282f6567231a95df954ed41fd7aab0cf0781d83751cc7bac366f1ca22d72d838577f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750362, "uuid": "92b50713-24b8-4822-b466-10f2ba528a88", "value": "T1A6649E30AB90C031E5F612FC49B693BCA92C7EB1572450CFA2D52AEA56346F4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750362, "uuid": "d8856101-d869-4b86-ab40-8d4ac4a6ee1c", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750362, "uuid": "bf3f3fde-f795-44dc-bb15-25f68920f456", "value": "6144:GhUCSexUjmIf21h1seKQQW3qjTqQ/Zhsje3wf3+:QSeGXu1D1wW3qVZIP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750362, "uuid": "e0e30af9-aa38-4c72-b77e-82a3bcdfea6c", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750362, "uuid": "69a55cd9-cd41-4da0-9b52-1d7f29666422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750362, "uuid": "766104b5-a064-4ccd-9e17-b1e9db132139", "value": "148305697d92d61210ae5edba017d0d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede1a516-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767070, "uuid": "aaa24ae0-bc50-4458-a7e7-433613833f0e", "comment": "Malware payload (Nitro)", "value": "23cb7de182b1553bbdd9c4066c7d1f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767070, "uuid": "1001661a-d327-45fa-89e6-977641f9e6c1", "comment": "Malware payload (Nitro)", "value": "7cca9ea23ca57d8ed6ac3f9a13b193703c04475c274920861edbfea78b4e44aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767070, "uuid": "0cc6a6a3-3833-4021-ae64-ea6a9382a688", "comment": "Malware payload (Nitro)", "value": "64fbafd3b5f5bba8ac5a664ae5534bf19edf1ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767070, "uuid": "0c2d6294-30ed-4101-b185-ea153966d3b9", "comment": "Malware payload (Nitro)", "value": "746e88427e361475d60e4bbb557577586c1f8d9748b735c9b567b813bd032f6dea57068333ec14280b34f85c75f16592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767070, "uuid": "4a8b3402-ea0f-48b3-8d5b-0aaa3edadf8b", "value": "T15D13D000BDCCD623DBAA86F958A7D6440B36B22E81E2D78FAD14F1D55D5B3E1051331B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767070, "uuid": "7278836c-d3e6-4135-b6a5-b7f901ce2f5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767070, "uuid": "24c73a8f-7a7e-418a-89bc-3771b2815a88", "value": "768:18cb/iFWqtitwWvDAnUFQ8idAvP4MxAhQ00sPOIdCyWVk+mqRuuH4C:1823gcDA6iKPeFXOkikkB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767070, "uuid": "61fe267d-6c7b-4bfe-87a2-20a2d98fa7d2", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767070, "uuid": "3807a3d6-bdff-42d9-b853-e369128c7f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767070, "uuid": "77226565-be19-444f-88c1-349223b807aa", "value": "23cb7de182b1553bbdd9c4066c7d1f3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1f087b-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628755126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755126, "uuid": "3727b509-1f7c-434c-bab4-915c9c242085", "comment": "Malware payload (SnakeKeylogger)", "value": "63f484e36e6533bce2a47bd946486c83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755126, "uuid": "d487c979-207d-4c7b-b1f9-39cf9735645a", "comment": "Malware payload (SnakeKeylogger)", "value": "7d6908ae43fb741400ac24a976de03ee6e72a8a306e3fdea805aa4257fb93f1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755126, "uuid": "8bbc18cf-8374-4c60-acd7-5f1891b187a1", "comment": "Malware payload (SnakeKeylogger)", "value": "8815f16a19e0f8c29587b241e635ddb66a0d54ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755126, "uuid": "4df6b9d4-7624-4da9-8753-d57477b97b2a", "comment": "Malware payload (SnakeKeylogger)", "value": "771a762c48496f515bf8c78629f4956fa30f16d0d49d815c502c7805009c8a614e523cecd87ab172ba3d83e09852460b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755126, "uuid": "c5d1f810-40d0-4556-bbfd-dfbdd71ee4ed", "value": "T16465F1AD329072EFD417DA72CE642C64EA65B4B7871BC207901706ADDE0E94BDF142F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755126, "uuid": "807ba559-e9ff-4472-b5dc-62b920631eac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755126, "uuid": "9f76bb25-e8f2-48a1-a593-dbe786ebd4c8", "value": "24576:zlVpguGi7f2lUAa6fUSCl8NOzx6UbW63+sV98VnUE+7nunaIYPrK:zjaGfNA3fUSClpxl53+sV98VqnunaI42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755126, "uuid": "60e7b1d4-20e9-4ae2-888d-2e1f3fe836fa", "value": 1414144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755126, "uuid": "811a6824-0780-44f9-a9bb-e8f54ad7c060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755126, "uuid": "e4003544-d315-4e98-9a29-24e17dcde7ee", "value": "63f484e36e6533bce2a47bd946486c83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a810eb5-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767225, "uuid": "fbe98546-18ff-41bd-85de-630db7a0883f", "comment": "Malware payload (Nitro)", "value": "96afa5e15f4cdbb0e1f51097e6acf4ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767225, "uuid": "1d4a4c12-a856-4fa2-94f3-75043c04d60f", "comment": "Malware payload (Nitro)", "value": "7d7f39ea140c1d58a017ffdd969c8a6f6201bfb578b4090b1e4588be84a7e29a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767225, "uuid": "66b5eb5c-c771-4809-ba16-55f3f5784b6b", "comment": "Malware payload (Nitro)", "value": "f38ea1b2f52f76a691a320a6a812a414cc0d2ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767225, "uuid": "d6dbfae9-0dc2-4de8-930d-e264618caae6", "comment": "Malware payload (Nitro)", "value": "9ed3e3284381f6a9a83fd986f532c2ea02b0ec3e508e8af8af98623a6cf6e9ccb30e10ed505bbc2b7333da51ad751775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767225, "uuid": "c5455960-bdad-4015-a0a6-4e6617f186e8", "value": "T108C3D51476638729C85C41B482EB2E7913F2AFC72172D79D6A68D3D92F023F6CE44786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767225, "uuid": "4d34f779-a99e-4751-a350-facb1136472c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767225, "uuid": "702703b5-dc3d-4ecd-8050-ac11b9399e4a", "value": "1536:pCIx2GoWviV8U5RG+B9cz5PdJQnAo045kna1h/9tiIx9XJKS2O8/ovxTR4r/3O:eZRJ2dg0Ut335KS38/ovJR46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767225, "uuid": "fbd869f3-f646-4427-8807-c0ae7673bb78", "value": 126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767225, "uuid": "4e5afe2b-bd81-4f77-a71f-c7330ed106dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767225, "uuid": "296fae45-8070-47dd-9cb7-eb05fc2fd565", "value": "96afa5e15f4cdbb0e1f51097e6acf4ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fa11f6-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767236, "uuid": "acdc7307-7740-4fd4-af2e-8e2701c476c0", "comment": "Malware payload (Nitro)", "value": "97d8e6f4f1b8eb550dc3bddbb248b517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767236, "uuid": "866eede7-6ddb-4d4e-a2b0-a210b8dc88ef", "comment": "Malware payload (Nitro)", "value": "7e9a5036fe2c20513b4fc397b1c0a4ef51377cc88b462f42650a14c953a16bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767236, "uuid": "eaf36876-3139-44de-8a0e-73d09cb41154", "comment": "Malware payload (Nitro)", "value": "3f86d5392f592da72adfbddd00114dd5c84402d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767236, "uuid": "c5e9381d-28f5-40c6-ac3a-3ad3ff2ccfdc", "comment": "Malware payload (Nitro)", "value": "d1c823f547ae2c0004216ae73b3ba4613f2c8dbf431cbfa43eaf09abc0f5f71ebfb1fb6d5d53c7536549e74aa6089a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767236, "uuid": "810912fe-8fe4-4dfb-9ea2-81c1c6b5ccd8", "value": "T15353532852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767236, "uuid": "d6b5ed96-0b89-4e0a-adbb-ed00c74d9546", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767236, "uuid": "20a7e07b-5f9b-495b-a476-f3d878e854e5", "value": "768:xKsMqCXfVcWO/M9ZkiANIUyyYLDwUzc80gmq3oP/oDw:xKseiM9ZkiAP2r/0O8/oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767236, "uuid": "a784921a-a181-41cd-9dc1-44fd34d1582b", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767236, "uuid": "ee1f9c5f-4867-4ec9-8459-6a4ea94e42d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767236, "uuid": "e04e951f-520d-4053-9976-210ad39e460a", "value": "97d8e6f4f1b8eb550dc3bddbb248b517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30869a94-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767611, "uuid": "706ac036-7756-43ee-b993-e4f8ff819826", "comment": "Malware payload (Nitro)", "value": "cad7af2b2714b813aa083c5e692cd7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767611, "uuid": "0ccc79cf-f23c-4f20-9e8a-82f55e711a81", "comment": "Malware payload (Nitro)", "value": "7eceee2d481d80031eb26f51bd11fbf9671c123107c83b0100b5dbaaf52ec833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767611, "uuid": "e19b34d2-a8c8-4609-a7ee-10de9fcf8333", "comment": "Malware payload (Nitro)", "value": "24eb7d428398fb6fe79da729e8ff416b0970d6d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767611, "uuid": "e54c98e9-caca-4688-addd-4f865c046a07", "comment": "Malware payload (Nitro)", "value": "bb3c009f6c28178ec7fb0332db3f617a5a8e29c4c549f2d52da8434d1ea07c106fbb21fb67ee0834f251c7dbe199d094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767611, "uuid": "82075765-599f-4f78-bf2e-3173924a0757", "value": "T1FC9665286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767611, "uuid": "12f95e90-b10f-46ad-b52f-273dd6a860a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767611, "uuid": "477ece5c-021d-42db-8759-4cb05d724794", "value": "768:HOucKn7n1JGDNANIUARbvLDwUzc80gmq3oP/oDE:HO2GDNAPA9r/0O8/o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767611, "uuid": "6a769268-31bb-40f1-85b7-d0ca567ed484", "value": 9437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767611, "uuid": "cd6d9743-cc96-4fd2-96ab-92b8db9010ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767611, "uuid": "e70f8a31-4059-4f3d-a49c-7ee6313908e0", "value": "cad7af2b2714b813aa083c5e692cd7ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f66010-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628775970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775970, "uuid": "58e2c6a7-e6cd-46bb-957b-d2c0da0647cf", "comment": "Malware payload (NanoCore)", "value": "e3021919c240cdba60a50a2428b7790f", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775970, "uuid": "6b63e3df-3b1b-46a5-a5bc-6d2619d9a1f2", "comment": "Malware payload (NanoCore)", "value": "7f1cd16cd2d2e5644752a3e0fd411c3902bad47051779d5bd539e9650f53787c", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775970, "uuid": "774f0928-f79b-4d52-ae1b-32fd78e2427f", "comment": "Malware payload (NanoCore)", "value": "5630036e3a31afe877c3ea59f70f86ee9b58566b", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775970, "uuid": "63c8ad20-5525-480a-9a62-dd4970e6a92d", "comment": "Malware payload (NanoCore)", "value": "7b0f1cd691ab315c47034e10362be69a0c0397374d9f5f43a25352337708bf1b3099dc19ee5b49963c6d9f0f20e3e754", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775970, "uuid": "420818b7-84d5-4477-b781-20106a4ac642", "value": "T1B5012801B901F1F39106F747DDF51279A6E7B6A49891A591206C829F00BB4AE2E83E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775970, "uuid": "66b6b89a-73eb-4b84-bd5e-eb14f2a0e4c6", "value": "12:dXVlTX7Fl9kQOGv9IXeNIf+8irXWMMeRo8N5zliwqhP/jvVlg7:Tl7FeG9geNlXLMeyMgV67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775970, "uuid": "539ad83a-303c-4e02-a26e-f1261608eea8", "value": 731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775970, "uuid": "f3dda9c6-a8eb-4326-84a6-f561d06f1c77", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775970, "uuid": "1baae05d-86d2-406e-aeab-9189c4658252", "value": "D5an3m8d5_Invoice_receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1a1634-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628776303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776303, "uuid": "3cd8e47a-d9c8-40e7-b2c9-815afeeb732f", "comment": "Malware payload (RedLineStealer)", "value": "52b4a7407fd8a1f3bb32cc9ed3da79a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776303, "uuid": "01560b7d-4d16-4f86-a7fe-8c1514634fe9", "comment": "Malware payload (RedLineStealer)", "value": "7fec25753b7597c9bf89e634043cc93f7bfd724d4c2f09e02b2c0aeefd0c99ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776303, "uuid": "543bd17c-0e74-4e16-b804-17d6bf722f7e", "comment": "Malware payload (RedLineStealer)", "value": "29c02260026787bca11f71fa091fe2591559c502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776303, "uuid": "1a184709-463f-48ae-8a39-d1d8e2de929a", "comment": "Malware payload (RedLineStealer)", "value": "c9edea6174f5178b26d6cb816074042bf9e40f787aeb5f38426be8eb70c221839c4c35f2286be33a31cda65b26945938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776303, "uuid": "5fc394ac-015d-4afc-832c-9e1b633c34c0", "value": "T143F3281B9408DCD5D8055FF2E5748B132233ED928E64F9983B8577076C9A1ACBCA0E7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776303, "uuid": "18b7c828-98bc-464e-93f3-dd769adbd9bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776303, "uuid": "d230750b-9cb1-4f5d-b368-12c9e17c4d3f", "value": "3072:USci13aquSPsnIv0JkQsENKclF87/e86tH2hclm8:USX13atSU+0+KNb87/e86x2hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776303, "uuid": "f5120da4-0db3-4309-8e93-7638cd296179", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776303, "uuid": "2e4cbdcf-3a62-459d-ba21-a036e0ead614", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776303, "uuid": "1ea01744-0e12-4524-8e5c-407e4b4b8689", "value": "52b4a7407fd8a1f3bb32cc9ed3da79a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa782f95-fb26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628742905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742905, "uuid": "b1d15eef-3349-426b-a153-11a80ac3424a", "comment": "Malware payload (Gafgyt)", "value": "9c88763f7d17914a9d2c9fe4774ec88e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742905, "uuid": "4f2f5273-cafd-4900-bf57-a347b83601bb", "comment": "Malware payload (Gafgyt)", "value": "8021b5c99ea0baeda2d2e7f5d3eb8ca635cb839cd12d41b17be9156dc90b6fc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742905, "uuid": "04c307aa-9ec5-41ed-b894-a363a5182f29", "comment": "Malware payload (Gafgyt)", "value": "245041d3b9db1c4da63b81a4518d7102de797f74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742905, "uuid": "46007d8b-a350-47c4-9772-984d6b7bc882", "comment": "Malware payload (Gafgyt)", "value": "33ae60acca55f22adb8032d5ee6f3b06b0c2bc26128e37d72801c42bebdf53fc9f3e6bf9488db0ce48610a8cb3a5e9ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742905, "uuid": "77557854-7f25-49b6-9208-5e947f464b87", "value": "T12E532B46F9008B17C1D32BBAA7DF475C3B366A54D7D7330165297EB42B827DC2A2A231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742905, "uuid": "a6cba620-abd8-423b-bb13-13ba7277fa53", "value": "768:MURlFT9cPiS2nfSzASMb3MMx6IMHsJ44VJXW/vsI4L0hBzb2sOIgKTja9nkT8oLn:RLZcPiqfMgCJxXIvsnL0Tzb2OgKGaz0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628742905, "uuid": "40f8b9f9-e4f6-4987-b894-63047c15a587", "value": 66592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628742905, "uuid": "ea705f41-416f-43ac-8804-e4802ac5d81a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742905, "uuid": "f4e8d521-758d-42cc-8101-96dd5f23c587", "value": "9c88763f7d17914a9d2c9fe4774ec88e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de4b40c-fb5a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628765164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765164, "uuid": "05610b1f-17ef-4f85-8542-0a858b9875c1", "comment": "Malware payload (RedLineStealer)", "value": "2d50222f6b702083c73d10e94eaaef9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765164, "uuid": "0b169c9b-cd42-4189-9d89-660baabb1edb", "comment": "Malware payload (RedLineStealer)", "value": "80752bd3e74c165e9c88fee2b806b67641f6cdae222d4ef9f5bc433f8501e767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765164, "uuid": "72bdc949-30fd-45e2-a251-f4a386630f78", "comment": "Malware payload (RedLineStealer)", "value": "dcce81eecbb46ef3963c8b4ad30f2ec3b14d2056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765164, "uuid": "97f4acfd-0be0-48c1-aca3-2812a6999d94", "comment": "Malware payload (RedLineStealer)", "value": "6bdc798c86f4c89ec231d77275ba4188b0465b238a1fb51f5fe6d918fd44b0a03facec377b67b773e9271d3555719ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765164, "uuid": "3e8c4d82-98d9-4018-946a-191a198fe03b", "value": "T17235016E7B845E11C1A81974C18384740BB25D873672E6093ECA32CA1E3A7D9BE5D7CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765164, "uuid": "57f98109-c26a-4d43-9dc8-f5d72c13b3e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765164, "uuid": "bdfefc4f-6d62-4907-814a-f8255a8139c1", "value": "24576:rRzS4127aD0WEjwizMRjgynPEeyTYQ/MuRJNObPztSC:I412GD0WEkihNYQZBObn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628765164, "uuid": "dcb2b340-40aa-4fe6-8507-3de2583e3dc8", "value": 1114328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628765164, "uuid": "15582573-fe76-42e9-8792-8c4158a87944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765164, "uuid": "17f260eb-a9b5-496d-9e7a-62b5ea5f10cc", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61704e79-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767264, "uuid": "dd120747-af94-4ec4-8619-ba98d8e5699f", "comment": "Malware payload (Nitro)", "value": "402cbc09109fbe9492924da0a07d43cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767264, "uuid": "cc366e98-fb4b-4bdf-a3c9-2fc4b5d740e6", "comment": "Malware payload (Nitro)", "value": "82a55487bd1c3b53eb0f0bee7483cae09792605e323b1df4b234582d21366d39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767264, "uuid": "0af7f6a4-4df8-42a9-8d9a-179cfe25d0a1", "comment": "Malware payload (Nitro)", "value": "6d1f1f99d07317ba3be2ac84130e3ad9a891f8b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767264, "uuid": "2cc35e71-3850-4aec-bbb6-b4d6cc3a368a", "comment": "Malware payload (Nitro)", "value": "7e2901a5d403ce2d3832444a65e277264916c6649bb466587930b78d644fe750124179ef7ab5d1fc5a9b3b7c676bbf2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767264, "uuid": "68c06e56-9b79-4881-b5ba-64abc9430edf", "value": "T100F43A6937996413C17F5B3544F2242BB37587E315A18BCC2AE2EB7727322C52A42EDC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767264, "uuid": "839ff2df-d7d1-44e2-b14b-de23541a3e00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767264, "uuid": "d88d4fb6-0863-46ea-8c11-d53f368f3d46", "value": "12288:gmnvJnQClbW3OZq+iSsEdLcDh5rseWn4zkvqrnmL3D:rQClb4SBLcDhy/Lqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767264, "uuid": "8ae1446f-7887-4adf-a340-c8c903b60194", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767264, "uuid": "8845e17d-3bea-4ef9-9d3a-9826c63289af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767264, "uuid": "6dfd14a5-34c9-4c76-b105-ccdfa9d9fe6a", "value": "402cbc09109fbe9492924da0a07d43cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766023bd-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628749260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749260, "uuid": "aa942131-8edd-48d9-bc7a-31fc5240e684", "comment": "Malware payload (Formbook)", "value": "d412ca9b87a56bffb27f3f8479e10aef", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749260, "uuid": "87287ed0-f94f-427c-9bd8-541d0edbd7b8", "comment": "Malware payload (Formbook)", "value": "82b5b3932d32d3c91730bad9dda00f872835609cbc922fc4e70dbf2d21f8c52a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749260, "uuid": "3891160d-0fd4-420b-b84b-2f5c5dea53cf", "comment": "Malware payload (Formbook)", "value": "af824f6bcbf67326b92ae2513f3251986fd19c59", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749260, "uuid": "c61f7e0d-2869-47da-87d5-355f5ba509cc", "comment": "Malware payload (Formbook)", "value": "7d2191d13f392179d251183bfa7bc603b8e1057624aba2b21b4edfeef0113b953b16d9726442801e62421ae9bc073ea4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749260, "uuid": "04e93698-db08-493a-8899-c628e9684ce8", "value": "T11F55125428D16645D08FA07E1F2392AB6FBC6D34F059832B3A683F1E613CB7746B11E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749260, "uuid": "ea8a4c2c-944a-4521-9d51-7839055706cd", "value": "24576:O/lSizvb1knCurVSjIbIhSlxmZ7QQlIgNxGSMveog/w7:O9SURknCurAsZxsmiUPeo2w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749260, "uuid": "399e827b-f916-468f-b16a-1e60b068d577", "value": 1282728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749260, "uuid": "df97d3da-56e3-41d2-84e0-bcc4cbc9be85", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749260, "uuid": "afd94734-4656-4fcc-a12b-50cc40e1062e", "value": "PO-AWSCOP.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909733a5-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1628750163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750163, "uuid": "125fd068-b02d-4d83-899f-7cdb480223b0", "comment": "Malware payload (KPOTStealer)", "value": "9ed5412682f264152209ba73af8c77fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750163, "uuid": "46367b6e-d59d-496e-bb7a-c3c8e3124017", "comment": "Malware payload (KPOTStealer)", "value": "82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750163, "uuid": "3c5416ee-ff6f-464f-a6c2-c5f069e79374", "comment": "Malware payload (KPOTStealer)", "value": "4da266bbfb0847f039aaab720aec23659f62b3e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750163, "uuid": "d15abbf2-a404-4242-94f0-2ab19ae54b8f", "comment": "Malware payload (KPOTStealer)", "value": "c906090cf282b4d94c6b023b1bbbfd5f0db06e45b0f3e1a9ed3c3e9b7434554e83fc5ffb53038279b4cdc995c37204be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750163, "uuid": "01d834c7-50fb-4cce-929c-478db3aff135", "value": "T144B4C031AB91C034E5F712F849BA937CA92D7EA0576440CF92E52AEE56306F4BC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750163, "uuid": "7b05c9c7-3c12-4d2a-bbfe-b9859e8792c0", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750163, "uuid": "9d657a09-5213-4561-8d61-f700dbcdb8db", "value": "12288:BWwOlnX3azDsim9VtclW4bAaMF2jEfZgsoH96GCay:B1OBnazzJWeMF2jEfZgsoYGCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750163, "uuid": "c04c0f76-dadf-45a3-aa48-11e39857a958", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750163, "uuid": "c498b816-3875-471c-a86e-770fb185d22e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750163, "uuid": "9ebca65b-fbb3-49d6-846d-33d3f3c343ec", "value": "9ed5412682f264152209ba73af8c77fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d115e6fb-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767451, "uuid": "c8805705-7c86-45a7-be93-1676bc4eb1e9", "comment": "Malware payload (Nitro)", "value": "876089195919aed795f6b51af4fcbc1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767451, "uuid": "771fec33-c3d4-4bcd-8690-6ef622afd2ed", "comment": "Malware payload (Nitro)", "value": "84216a69d8bc0a907ee844c023648119c70023fed01cd9f81d1cdb4ffd33e605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767451, "uuid": "293c903b-b012-40ca-b028-4c794381209c", "comment": "Malware payload (Nitro)", "value": "31c945b05fb283003403857155d4ca164b392bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767451, "uuid": "228f3271-1a29-4af6-a6f2-c829eb2346d6", "comment": "Malware payload (Nitro)", "value": "2d70efa9269ed2247baff87e9f247b7977d1df163199b008822f37e6ec04fc2379ee773e17962bc891f2527cbd34e9c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767451, "uuid": "55a9bd10-1a16-4279-8014-4069b6368f51", "value": "T15953502991738A3DC82C81B811EB6FBC27B09F565450C76E4AB8E2AC3E573F79C14746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767451, "uuid": "0dc3e069-6afe-4d18-97b0-b617994013d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767451, "uuid": "c8279db9-e888-454f-966e-cce2ffe8d58f", "value": "768:Sq6FaQCLDwUzc8Agmq3oP/oD2ww2oG4f1G50F7iEb1L4uP5My1:SqZQCr/AO8/o6ww2p350xfb1L4mam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767451, "uuid": "9b0269ba-c123-4429-937d-b943534de641", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767451, "uuid": "5997eee0-a3d7-4ff9-87da-58926db582b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767451, "uuid": "faa4e43c-c160-4aeb-a81b-ec2f5fa71698", "value": "876089195919aed795f6b51af4fcbc1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3edac05-fb47-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628757148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757148, "uuid": "ddaaad46-3cde-4a90-ba98-cee1a454ab01", "comment": "Malware payload (Formbook)", "value": "c7ece25f5f2bec6d7287b7a531e14d44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757148, "uuid": "bab864ae-ce31-47c1-9f8f-734564b43632", "comment": "Malware payload (Formbook)", "value": "84617e9b429736d15a45e1d0c75cd39c60b0387168fc9f46bfd4eb8b7e2d50fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757148, "uuid": "7b222d27-3f84-499e-9946-15318fc122c7", "comment": "Malware payload (Formbook)", "value": "5c50667f702618200dcae44bf286d8fd00b6425f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757148, "uuid": "ebc55dda-139d-4592-9d28-7eaabd773171", "comment": "Malware payload (Formbook)", "value": "56df088edaa5b67926c776cb9c966c5f98a928616504f62e5b4a3848997e3e91dc0d9f15ea1be829769efb6a67ecdeb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757148, "uuid": "f997bae0-ed66-4bc5-98e3-90299247536a", "value": "T11BF48D7B23DA6BFEC9B492F91010109356F298151826DA6F7CFDF2CD28647610B398E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757148, "uuid": "6aecad45-0543-4816-ad67-dfa168847835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757148, "uuid": "149bb4f8-15e7-46d4-a6b8-250444f527ec", "value": "12288:gAGUhizuXCzXDUOWApOa652CyQLipX5x/vj9Ll:gqhiqSz7mR/+Nvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757148, "uuid": "baa1d761-2a5c-4707-a866-0fb628839799", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757148, "uuid": "0b601258-c737-43fb-b94d-15ca9f472891", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757148, "uuid": "e05120f4-e333-4325-936a-d1bf877f7a86", "value": "c7ece25f5f2bec6d7287b7a531e14d44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3e8a7d-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767496, "uuid": "571ea8f1-363c-4e95-892d-59a0fa3685c4", "comment": "Malware payload (Nitro)", "value": "a382153ad18d0c95006b5c4c197efca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767496, "uuid": "5f0a1dea-3492-4cce-ac89-db397b6a715a", "comment": "Malware payload (Nitro)", "value": "85de0898ff39ffa8fce097fa675551106ec38e47c93dfc8cd2d35f460a0d9eac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767496, "uuid": "e64c9629-9105-4bef-87a7-4b99fa6f14e4", "comment": "Malware payload (Nitro)", "value": "6f8b2a57b75d20c2c9707dfe8e3c0a2c8a1380c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767496, "uuid": "35371517-fe42-453e-b811-15196188e959", "comment": "Malware payload (Nitro)", "value": "68a32acd5f79210c25ec15c8b2fe66cadcbffa09fd9d0bc65a058eb3d16e5a51291b1cff9e84ea55299c085cb26da336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767496, "uuid": "97c7c87d-1834-4b50-8db3-60bbecdd0b7c", "value": "T1DA53552851738A2CD47C82B815EB2FBC27B0AF566860C75D4A78D29C3F277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767496, "uuid": "758ff294-20a2-4502-be60-d2c814e9d4b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767496, "uuid": "7b0f2ef9-27c4-48c8-a01e-6c5b9000cf26", "value": "768:vnmqruBPuQDuKZBQA0KadVR2LDwUzc80gmq3oP/oDn:vncTpO74r/0O8/oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767496, "uuid": "c0524782-90f0-4ae0-b4ed-0dc3da9fe54a", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767496, "uuid": "5009a9d3-ff69-4dcc-a709-38ddf11cc1c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767496, "uuid": "36fb8925-0e25-48cd-aa12-6ac5eea78d4a", "value": "a382153ad18d0c95006b5c4c197efca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079fb8d5-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767542, "uuid": "fc80d1c1-986b-400a-9338-0ddbe3a78d9c", "comment": "Malware payload (Nitro)", "value": "bcd9ef95a12986a5dcbcb2a9095f98c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767542, "uuid": "8e684848-eb37-4071-bdbd-a6c802706fb5", "comment": "Malware payload (Nitro)", "value": "85f026e79d6d1008c6deec920762e3efb045aa7b1554fd1e063944c17d9a6c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767542, "uuid": "238ca68a-8c74-44ba-a221-c26e294c2338", "comment": "Malware payload (Nitro)", "value": "f71b4bbc2416ab75f5b889a936cd8a5b6932b705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767542, "uuid": "ecf0b2b4-aee6-4399-95b6-c19b6b80aa3e", "comment": "Malware payload (Nitro)", "value": "2935f1ed83f1bdcb52210f7e2574bdf7ee9013e43e02e9055e5983f9c8bde70c3bcee6144a60dbf4db4ef6299e4cef53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767542, "uuid": "19cf467e-b9aa-4021-8d41-24fa162ea6c4", "value": "T10353642852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767542, "uuid": "b90f3484-130b-4a0d-b081-ec18ee186f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767542, "uuid": "f6351e02-613a-4cc4-8a87-32af4c6870a1", "value": "768:MKsMqCXfVcWBTM9ZkiANIUsyPYLDwUzc80gmq3oP/oDi:MKseZM9ZkiAP2r/0O8/ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767542, "uuid": "a392d9d1-4e99-412c-bac1-cafe02555fc4", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767542, "uuid": "2936fd76-aeb6-4b15-9105-391f817de5dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767542, "uuid": "b4caafe5-25ef-467b-aff1-d965f591c430", "value": "bcd9ef95a12986a5dcbcb2a9095f98c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37fa9eb-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628755375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755375, "uuid": "8b31993e-e93b-47eb-bb8f-de990d4e94f3", "comment": "Malware payload (Formbook)", "value": "bd2c6dc178b0c292a9f6d62a1c4121a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755375, "uuid": "63db76eb-d15b-4873-b446-b0cd9da8b7d1", "comment": "Malware payload (Formbook)", "value": "878730d98ca2b265653a8c94f41fbb35a564fd36453a04c830d7c59a626f633e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755375, "uuid": "648a0a68-0c42-404b-a47f-931f8e85525b", "comment": "Malware payload (Formbook)", "value": "c404a10b1aa3a7717dccdef2c4928575df91d520", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755375, "uuid": "00c88a57-c23b-47a0-8f7d-b96ad6adcd46", "comment": "Malware payload (Formbook)", "value": "17aaeaff8edc2e4531386851f144fa45c5e5483e84244176c5ab4398d26d7bbb3dae73227862c58bc4c988b48530a602", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755375, "uuid": "ac47fcd8-a664-4200-91ea-606d7a38b037", "value": "T14065D53C29BA2627D07AD775CBE59827F4509CAF3151BD94A4CA73260372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755375, "uuid": "7b613b6b-e6a7-43ea-a282-85ffede5fef4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755375, "uuid": "e90b9e14-4d4a-496a-b76e-1878f13206dd", "value": "24576:c/Osi4KToMMxTJNglRgymzIiQGNuFH6T2fX/vO9:Hsi4KToJIlRbIXLuFH6T2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755375, "uuid": "fb8a93cc-47d5-4ffe-9307-f1c54072defd", "value": 1476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755375, "uuid": "8e2ced67-5280-4681-a8e4-33f26a8c760a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755375, "uuid": "6669a2e3-48b3-4db9-8d78-f080f35287f7", "value": "bd2c6dc178b0c292a9f6d62a1c4121a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a721f4-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767677, "uuid": "063f9acf-905a-49df-b67f-0eb8f674d9d9", "comment": "Malware payload (Nitro)", "value": "d6384e6c1be120aba258958e7c4494ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767677, "uuid": "728c74ca-b012-4310-aec8-739860a13fac", "comment": "Malware payload (Nitro)", "value": "87a3af8778ebd3a937eec4d8a57051a6ba0a5186332122684c8107c47eb07585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767677, "uuid": "e63bb525-83f2-4122-b9fa-c90e0feb7d53", "comment": "Malware payload (Nitro)", "value": "2fc9ee4e4e576437a828e18c0c6abb496eceb988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767677, "uuid": "8a7351b9-73b2-42f9-8f1f-053511763fe8", "comment": "Malware payload (Nitro)", "value": "a5ea795df23fa28ab4834fcdcc2fcdd9ec63fa1359e2ea0443ac9d499e747c0234365008cb30751221750fb310fedfef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767677, "uuid": "c8ad7370-de7a-4ad7-bfcd-0ddc84607f37", "value": "T1BF53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767677, "uuid": "dd37572f-ffef-4d67-bcd5-d8043236650c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767677, "uuid": "79e078c8-9e0e-4f96-abf5-807b38506397", "value": "768:cKsMqCXfVcWO/M9ZkiANIUoDYLDwUzc80gmq3oP/oDX:cKseiM9ZkiAPvr/0O8/or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767677, "uuid": "4887c070-cfc2-4580-812e-025726e712fb", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767677, "uuid": "44d6b253-30e5-4076-bdad-b3215a9ea19a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767677, "uuid": "ca5ed873-9cc0-4f35-8667-6c13418801db", "value": "d6384e6c1be120aba258958e7c4494ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8efdb79-fb68-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628771249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771249, "uuid": "286cdb57-1f5d-4adc-b94c-7d07bf79e27f", "comment": "Malware payload (Formbook)", "value": "1769981b2c003c0225cdaf619b4a2c89", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771249, "uuid": "eb5b5700-0f7b-4c41-b0f1-acdc8683468f", "comment": "Malware payload (Formbook)", "value": "87d4f56ce5c913179ac176837603f2963884ce6f71df4d079bb8ba6faee3fca3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771249, "uuid": "65a0db98-4a6d-4c78-88f5-0b9de0067ea0", "comment": "Malware payload (Formbook)", "value": "b518e1859cda8fab4e1cf55c622a2c7a3e3f0eb0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771249, "uuid": "2539ced4-5ab7-40e5-9bc3-74d1c122cf7e", "comment": "Malware payload (Formbook)", "value": "1b679a0a950e7eb7bc57d940293008867921adcab211915443c9fe7a1ffe45fcee0517bdb9e4ce4da74f540b31375aea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771249, "uuid": "743a858b-4df5-408b-8c55-f24c51a15f52", "value": "T1415523D4BFB80343F50BF5B84055CA1428ACDF276618FC9EF622718B1BB3D6819D6A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771249, "uuid": "a3f3087b-2c5b-428b-98a2-4162b888ad0a", "value": "24576:AxhiCWJsu4Q86/MpSPgdq9Y2M+RLDJu2fZ1Z/CzJsUN4ksPkkbhhhhhhhh/hhhhR:auJCs/MpSIqa2nNJu2fbNCxN4ksZZPZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771249, "uuid": "34469f35-b634-468f-beac-c65cf6864e6f", "value": 1280792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771249, "uuid": "e58a2b15-5e24-4b2f-8f0d-bb45e4d7937d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771249, "uuid": "151b4493-1c71-4b41-b993-7f5302976f9a", "value": "Transfer_form_$157,890.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690fa036-fb6f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628774148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774148, "uuid": "c65b3cc5-fa76-447d-8ce8-232f26b701a3", "comment": "Malware payload (AgentTesla)", "value": "58b35fa2bfdc3438d2fb91ec4f8421f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774148, "uuid": "d2cd7564-fdfd-4c10-aa89-d7062aca6a9e", "comment": "Malware payload (AgentTesla)", "value": "88263a8938955ebaa8edb9484f39876b5968c35a66cf9a8b8267e37ba7539900", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774148, "uuid": "bf013377-a326-4307-ab11-5985be731626", "comment": "Malware payload (AgentTesla)", "value": "bb15df213ffd9c8dc546af9daa2036a48d1f0fc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774148, "uuid": "a28cf2c3-8117-454f-9929-ef58072f12c4", "comment": "Malware payload (AgentTesla)", "value": "b13f1f370b6ea01a8d85a73649788b82d5606881da158771d6367aabda1a30f3db27ca095f73ececc2b5d3f47054fb1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774148, "uuid": "c7b1b542-ac40-4823-8c91-4fd3e5802930", "value": "T1BC55F069324075FEC867CA3289541C10EA606C6687CFD37E60137DA9DEFE99B8B101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774148, "uuid": "33e7fb4e-19c5-4e56-b182-fa055cd9dc4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774148, "uuid": "8120ad23-4fce-41b9-829f-4646af8510c6", "value": "24576:zvMNtI0oJ8EFn3Qcd1ofKGHXuei1GZZS5R0:zvemzbAeLG3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628774148, "uuid": "ded019ae-e252-41b0-a87e-127dbbe32f3d", "value": 1290752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628774148, "uuid": "e78f6abc-74ea-47cc-b56d-8fd621b924f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774148, "uuid": "803519c7-c2fa-4ce7-8d3a-83a0ab4801ab", "value": "SOA#J789590D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f5fc48-fb9f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628794866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628794866, "uuid": "31f26499-dce0-4ee9-9a83-5753ba350d0c", "comment": "Malware payload (njrat)", "value": "1c352948c1f3961f7eaf08538d7c8d40", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628794866, "uuid": "3dde2481-a423-4751-aefb-2cf777344aa6", "comment": "Malware payload (njrat)", "value": "89aea7429e8634bbba4d97c8576adb9568cdf91830d15ecd2c34c5a290f7b83f", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628794866, "uuid": "06ae7515-cab3-443f-a474-e9764cef70bf", "comment": "Malware payload (njrat)", "value": "8b0689795609db5049a578f0992e3f5683aebb21", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628794866, "uuid": "1a670136-366d-426a-8d9b-e2ac615abc18", "comment": "Malware payload (njrat)", "value": "6081ca60727b15ef26554b19f0711dc0cb8789372f303d2000b35c2d750cb7cad87e20f194153d28c0842aadbba62452", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628794866, "uuid": "85e4c516-6e8e-44ec-9d40-f8b8ae355bc7", "value": "T100012801BA11F1E39106F747DDF11379A6E7B6A49895A591206C829F00BB4AE2E83E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628794866, "uuid": "6b97cffb-57a5-476a-abad-aabc655403a8", "value": "12:dXVlTX7Fl9kQOGv9IXeN1sf+8irXWMMeRo8N5zliwqhP/jvVlg7:Tl7FeG9geNfXLMeyMgV67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628794866, "uuid": "2f562731-cbf5-4787-b3a9-8df1c7c800bf", "value": 731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628794866, "uuid": "a4e867bb-256c-4da4-bee9-2936725a3212", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628794866, "uuid": "5ad2504b-0141-4a1a-b0e8-0497dbc6e4d2", "value": "Gy2k4h2g4Invoicereceipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfbd464-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767764, "uuid": "40148289-f69a-45d4-bc9c-70c0e7f252c0", "comment": "Malware payload (Nitro)", "value": "ffacbfc8d3eea280c3e66b54c8515ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767764, "uuid": "6db7975e-4ac0-48b0-ab04-f07b85fe811d", "comment": "Malware payload (Nitro)", "value": "89dbea1e4b387325f21c784dc72fcf52599f69e1ded27d1b830ff57ae4831559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767764, "uuid": "fbd6565d-d823-446e-96f3-9c984a145169", "comment": "Malware payload (Nitro)", "value": "13dd779845c699e46a35f71baee783a87068da1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767764, "uuid": "88b98663-17c0-460c-b085-92fb690a1e02", "comment": "Malware payload (Nitro)", "value": "d5bd51a78c5236284c707688835cd6f4d7ba2bd24d72635b05acd5ff72562fa4ab6b1dac627d0e38410ee4138853b3cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767764, "uuid": "a1ee3d38-036d-44f3-8f2d-4c15f68cf17b", "value": "T13F53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767764, "uuid": "19df96a2-804d-4546-b23b-306f1892aafa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767764, "uuid": "c4164e4d-6966-43ec-94e4-b1b970c35bb9", "value": "768:gKsMqCXfVcW42vM9ZkiANIUyeYLDwUzc80gmq3oP/oDe:gKse4qM9ZkiAPGr/0O8/oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767764, "uuid": "6d9adcb8-56ca-4155-9092-d4e31d9f2612", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767764, "uuid": "afc97e42-0f7b-4ad6-91f5-a1f1454ed62e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767764, "uuid": "5688e8d2-e146-4170-b04d-f447f0efb6ad", "value": "ffacbfc8d3eea280c3e66b54c8515ab7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d760460-fb55-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628762935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762935, "uuid": "9b1277dc-bcb2-40c7-ab4a-b709d8eb0458", "comment": "Malware payload", "value": "f774a850154743d1e803e5ae3bf5fc28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762935, "uuid": "7f2ef48f-9fea-4a46-9a64-0a6d0f839b49", "comment": "Malware payload", "value": "89e906e65ee2d7fac614e5e6f7383a4fd1846ef07007d06797714b7dfbb3e358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762935, "uuid": "f9aecd28-87cd-469a-b584-1434010808e6", "comment": "Malware payload", "value": "1c0c247c88e68915dc299df2e679579d1ab93de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762935, "uuid": "604a2bb5-2427-42b8-be6a-9784a68021dc", "comment": "Malware payload", "value": "4eae2ed645ab23726b7f7d9a756b235a97f6949e3c2b56163b0e6cba5675e3fc00be05b5202a5152c24efc77ccc4d9d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762935, "uuid": "15344a0b-5364-450c-9740-55c76ed6c409", "value": "T126259D26F291B837CA672D39AC57B764E82A7B101A2C64472BFD1C885F3C6413D7E346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762935, "uuid": "35a7a985-baf1-41ea-8a77-89eb6258d2c5", "value": "39334fad6fc37ecf56243de5802e190c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762935, "uuid": "fc405402-1f5b-491c-a3bf-b98ec0c11975", "value": "12288:lq1zaytHkdB6KK/2v7YNZIeT76kASvukn/rML9zpteqDaGud9z:lqVayP/2TYNhaliD4eqDaGAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628762935, "uuid": "6529d692-d7b5-4b84-8480-6add54d56b05", "value": 965122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628762935, "uuid": "8c0277df-11c1-4b68-866e-6e29323f9d8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762935, "uuid": "8992ef65-c3b4-46db-9bcc-5761413819a9", "value": "SecuriteInfo.com.W32.AIDetect.malware2.401.3225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6941af09-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766847, "uuid": "154262da-69c6-4371-aa3e-87d2d75c5cff", "comment": "Malware payload (Nitro)", "value": "2a851d7c8be29c5fc3bcd30329956ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766847, "uuid": "014d7c4d-42d0-4140-a707-7415acf86141", "comment": "Malware payload (Nitro)", "value": "8b1c2384d904f25a64d3f35a84aa6e2e4cafa6cbba168e02a08741d6ddab9e7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766847, "uuid": "f42fd27c-20c4-49d7-9a87-f3ffb39a6e57", "comment": "Malware payload (Nitro)", "value": "b33309e99079b063c8b4713246a5fc1f503ed3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766847, "uuid": "1c661b2b-2802-429d-8c37-6e1feb9f2787", "comment": "Malware payload (Nitro)", "value": "1913a9df26bfa7e886cf4c4d8501062f0ffdcafb4800dea95001034b4ffab9b34d926e8e38ebfb5c395c7bcd27e354d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766847, "uuid": "5d4941b9-bd6b-4169-91ae-decc6beef85b", "value": "T1EA53432851738A2DC47C82B815FB2FBC27B0AF566460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766847, "uuid": "2ba0c14c-8a29-4d70-be65-eaa3934a2955", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766847, "uuid": "7ab499ca-cfd8-4153-b0cb-be97d3009cf3", "value": "768:VnbyqCXfVtfAD8TJWn0u7sANI4svYLDwUzc80gmq3oP/oDh:VnbEAD6WnzsAxfr/0O8/ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766847, "uuid": "e6432256-5f7d-4369-9317-e883daeff25d", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766847, "uuid": "060ba71d-beba-46ff-9242-4fe7f909772b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766847, "uuid": "aee160d0-1eef-44af-8b61-511e6ff75826", "value": "2a851d7c8be29c5fc3bcd30329956ffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee798bf-fb19-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628737409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737409, "uuid": "b33611ca-fcf2-4e9d-b1db-eaeb21624edd", "comment": "Malware payload (Gafgyt)", "value": "5bf3af2879b67659826b419dba080665", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737409, "uuid": "b7e4ed50-4b35-497f-b210-26fcc3526d3a", "comment": "Malware payload (Gafgyt)", "value": "8b5d8acc301d56bbfe4d3dfd94983a6bb2aac05bc0ca6217ee2d4aeb3876ce03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737409, "uuid": "1f5578e4-fa59-43c5-aaa7-07f4cc6df77c", "comment": "Malware payload (Gafgyt)", "value": "d2a9513ef239c23be75096a0903ca409b66041e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737409, "uuid": "139247ac-df86-4e45-9781-ae606932d38c", "comment": "Malware payload (Gafgyt)", "value": "222aacd090e2a9167b2d7679c0d1c4d12804494172472160922b6e87ad31eb1d926f15697bb95394b7507bdc277a4605", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737409, "uuid": "72e64e98-22e3-48e7-9e98-dfd4616cb9d0", "value": "T1CBB32801D5508B27C2D2277AB79F825D33232BA897DB33165A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737409, "uuid": "e3223157-e82a-4ca9-b258-03deaf9e212c", "value": "3072:wdA0a++h8tZ2hWJlotfDq9jBy/bmTQOWsXAOn:wy0a++h8NotfDqgbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737409, "uuid": "0f189c4a-d88a-4e81-9b1b-ba9a979e38cc", "value": 111528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737409, "uuid": "c93fc044-b9c9-492f-82c3-031a1a42035a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737409, "uuid": "abecd646-1fbe-4b9a-8918-070661a1540d", "value": "5bf3af2879b67659826b419dba080665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414a35fc-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1628776229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776229, "uuid": "ce55e215-ded1-4527-8281-5842012ab011", "comment": "Malware payload (GuLoader)", "value": "d07ea7cdad0487bb7bc0cd64330a89f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776229, "uuid": "34c5f98f-536e-432e-81fb-88eed149eeeb", "comment": "Malware payload (GuLoader)", "value": "8bef4e95bce87f7580bd453b8e4ef5a434d1587d9bb98a2b550154349c92b612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776229, "uuid": "54e489c8-69ab-4c0b-a03f-e0d7f15d4cff", "comment": "Malware payload (GuLoader)", "value": "93cef7b5767f493612601e0d0633247afd37f8a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776229, "uuid": "4dca4696-4978-4213-b123-a4540bfd800e", "comment": "Malware payload (GuLoader)", "value": "cef98c6e40980c597e8271d8d6ffd7409448b2360ead50618a263bfab62ac1c4f7ad4dac74be3ebc1096aadd84f3a886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776229, "uuid": "b775206b-c894-4343-906c-3de844cfd6a4", "value": "T18F74F70BB10249D6DCF84DB61B1F4ABC65C4E87E834DBB8621C06D3752A8993B6D3E4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776229, "uuid": "76132088-a4a3-4f77-adab-3d94b075f8b1", "value": "321218565a2c0073229919d84fd53329", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776229, "uuid": "bea67808-d9d5-4f86-b5e3-063d1ef4a7df", "value": "3072:S67xyu1EPgm3zXf1q699t5bF2z7yhkHa6Zt29mAk+TGc4:SuxX63f1f9t5p5h2a6ZeL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776229, "uuid": "c2bb444c-bf27-4ea0-a3cf-4b1d2624e398", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776229, "uuid": "b886289f-7d87-4363-9aad-f41697ffd804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776229, "uuid": "e0dd0216-fcb3-4a9a-914d-5df8c6b33d1f", "value": "19-9901B \uc608\ucc9c\uc591\uc218\ubc1c\uc804 \uc81c\uc791 \ubc0f \ub0a9\ud488 \uc124\uce58\uacf5\uc0ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770b7ba1-fb02-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628727357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727357, "uuid": "96ab34f7-e1fd-479a-82ca-daf56be17de5", "comment": "Malware payload (Mirai)", "value": "112f6c6f354f0a42061f3b4920784b57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727357, "uuid": "ede82a87-3b6b-44e6-a707-c31dd3f890e5", "comment": "Malware payload (Mirai)", "value": "8d88a637b20ad427fa0d16290b89ebb6917972c22f1a6509f3c79aa6dda794d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727357, "uuid": "ae8e80b1-ba9e-4ccb-aca0-96aa625b8aec", "comment": "Malware payload (Mirai)", "value": "5768a5e91e894378701c30df95ec6453e350d245", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727357, "uuid": "f662afe0-5eb1-42e7-8c29-31e0cedb3b21", "comment": "Malware payload (Mirai)", "value": "c71abcfd14564b172709116b046409ea5fd5841300fc2f501dc668027079b01e2ab4afe66d79f9c4ecfbad1aaab36bf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727357, "uuid": "5ebedbb9-ed55-4c62-a8fc-5c8bfe286c5c", "value": "T1C4732896B8919A22C6D4137BFA6E41CD372163E8D2DF3207AD202F647BC681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727357, "uuid": "b0faa6c7-8869-4483-a169-6e02c7e20eea", "value": "1536:fpXcKpBUlet3DBboJubLCNgpRTZankcahWMP1hB4g5W9/e35fEFs:fpXcKLU1cRYnkvhTtQgt3eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628727357, "uuid": "8dda9da9-bdc0-4d24-889b-f488a7ca189e", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628727357, "uuid": "baebd1af-91fc-483b-838d-5907e576be59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727357, "uuid": "a8d1fcd9-8280-4b85-8551-a731303481fe", "value": "112f6c6f354f0a42061f3b4920784b57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a636041-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738019, "uuid": "9592b1fa-fba3-4cf9-bf8d-c058802bc536", "comment": "Malware payload (Mirai)", "value": "49f89dcc94c0a8903c7fd2783c003d7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738019, "uuid": "5a60e300-3108-45b0-a900-54e4a8f578cd", "comment": "Malware payload (Mirai)", "value": "8e0c657a9c78c500fcf0b1c768bf19dfac59dec6ab9f067bc4d0e7c4d02cfb2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738019, "uuid": "c4e1c237-f69d-4276-a381-dbf05b997cef", "comment": "Malware payload (Mirai)", "value": "4df586fe5c24bc301c16f776fce0489dd7fb4424", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738019, "uuid": "affc7c31-9aec-4c86-906d-d66e62bd596a", "comment": "Malware payload (Mirai)", "value": "31f0e927c9062b5cf2147010fee3cee7eaf4ba11f65b6b3a848bf4e20a7ee353bfe1f68c8fa759797b9e7df6ea591af5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738019, "uuid": "f067c2c0-961d-42bb-a031-9ae3f7f811c0", "value": "T1B4B33A57671C0B43C58B5AF52C7737F187ADEA7112E221C5E40EBF801B72A701A26FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738019, "uuid": "18f1b3af-9f02-4b04-b41a-94bf4f884901", "value": "3072:FHXfEEPOH0UHNzONBbsQF5h7z7ku62QnI0PDG4gQNcR:F3LRUHNzOwQF5h7zQ2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738019, "uuid": "de296c8c-b508-47ae-9cac-70be8b86f932", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738019, "uuid": "a79c2f2c-59fe-4c78-a948-56d3f602c586", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738019, "uuid": "542b1761-14be-484f-a235-1fda4118fea7", "value": "49f89dcc94c0a8903c7fd2783c003d7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e8c974-fb33-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628748217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748217, "uuid": "2ab8ce62-0d6a-462c-a52b-6dfba873fe9f", "comment": "Malware payload", "value": "bbbc3f459b820b0d8e0a4f046c256e2c", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748217, "uuid": "b9465de2-9dd7-4d8b-a8c8-31fd5bf7a4e9", "comment": "Malware payload", "value": "8e1ca77967dd299b9dd78461f5bb5556dfadb43da5a327f677b8d3ade2c4d571", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748217, "uuid": "6fddb597-0726-4d1f-a37d-7e2f1cc45690", "comment": "Malware payload", "value": "31f38d5ef51f9b1036cc4191dcfbfb0775df7f3b", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748217, "uuid": "cea08e59-9f77-4e69-9f63-fc545b748833", "comment": "Malware payload", "value": "43eefeabc028f9f57e30aea2f174ec3fbd82ae30010b5bdbe6388a01e7fc32f23e56280b535b7d66588e67e41ea75595", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748217, "uuid": "8cc3563d-4927-4689-80ef-aa61f209c8d7", "value": "T148E18423F042843C9B604D19FFDFAA8853D5D418134AC3DE3A2B74B9BD8564464EA1FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748217, "uuid": "8717b4cd-1650-4161-aed0-017746a2004a", "value": "96:UXwFzfahl1jyEiWhHsaHR6e/F/sipQfajQ+dfj4wsV9xHrp:UXwhu3yc1saHRBbpQfajQ4xgxHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748217, "uuid": "5fe3f794-e672-4853-9cde-822da7599200", "value": 7362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748217, "uuid": "eb3b4b93-78d9-49c7-ae86-2606a9e6a92b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748217, "uuid": "cf05daa0-7b06-42b2-8a86-96ca301723b7", "value": "27-37368216.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0ac641-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738666, "uuid": "75379789-1a1c-4431-972c-4b719cad6fd5", "comment": "Malware payload (Mirai)", "value": "28abf797f69af719501910a6c5f796cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738666, "uuid": "52197096-3375-4863-8dab-eb509dd49002", "comment": "Malware payload (Mirai)", "value": "8ef4e9cc00230449981ed3e65ff748acadd30f81756806dacff4067118db6c7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738666, "uuid": "96769ad4-8e8a-49b6-9226-e4fd8af9cb4c", "comment": "Malware payload (Mirai)", "value": "1597cdddd7077963979fc515feb1da6e67122b7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738666, "uuid": "f6239b77-20a5-43a6-a5a6-c2d430c2d27c", "comment": "Malware payload (Mirai)", "value": "9cb6f73a2300c0320be822a04134ac28e7b22eb58afc3942ee418fd661526cce4b413ad234cd12c591b9d9d60cb470e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738666, "uuid": "b11f4339-4169-4c29-b4ec-b850b2fb6f66", "value": "T10043023C2213BD21AE7199B1ADE6DB550AEC6F78F13EE4B246B44D3D1DC1D8029A418F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738666, "uuid": "4bfdf378-6da3-4178-95aa-a0319e594444", "value": "768:2Up+tV2jefwtobs6ItuI40HRFCKr2Z+Zkb9q3UELF4dvBt7k3nXVbpdXXd7:2UItVYtJ6c4yFC02ZSFLevwnJXd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738666, "uuid": "7d22daf1-92f8-47a8-960d-579915f916cb", "value": 55676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738666, "uuid": "1ed201e4-aa1a-4bea-ba72-922280d3a321", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738666, "uuid": "86f6b280-e045-45b4-9ea2-db5570c5120a", "value": "28abf797f69af719501910a6c5f796cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdebacd2-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767016, "uuid": "eef00b51-2db5-44e5-9bca-9c4a0be9b22f", "comment": "Malware payload (Nitro)", "value": "9f5707816aea4bbe395676187269a547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767016, "uuid": "681a65e7-73e0-405c-a96f-d73522469848", "comment": "Malware payload (Nitro)", "value": "8f9533aeee2064abb573e4d75b89b907e57d7d2fb7b2588fee88a903c2a7f735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767016, "uuid": "ba01c777-5589-48c7-9f7c-d07c87e9076f", "comment": "Malware payload (Nitro)", "value": "9aeedd62bd3f7c0a3501725c69b2493ac2f5ee13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767016, "uuid": "82c72d9e-a391-4498-819d-3cf204af7f22", "comment": "Malware payload (Nitro)", "value": "3590535a28b32267d0e2f5836cb91d7795f52a843dd96c263c39a78099e332857545381d74fc016313836c7094abb139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767016, "uuid": "f34f97bb-78f1-4883-8977-470051563328", "value": "T12F5364246273892EC57C81B811FB2FBC1BB0AF166460C79D4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767016, "uuid": "f16a45a6-37b8-4aa1-9a8b-7e0e1a8f682f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767016, "uuid": "0ef31c53-26a6-4319-b6c7-7b14e034908f", "value": "768:ROo9osCdarCuqEUoJIHDp8LDwUzc80gmq3oP/oDV:ROmGuqho4yr/0O8/oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767016, "uuid": "9a96ee1b-a796-4b58-9d38-99bc37429396", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767016, "uuid": "a34fcac7-b25a-4e41-8edf-ee62d932cd17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767016, "uuid": "d3894fd3-199a-4cf9-9d78-a4f506a74174", "value": "9f5707816aea4bbe395676187269a547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3fe493-fb75-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628776736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776736, "uuid": "bb556fe8-81e8-41a8-ae4f-7dc9208ab71a", "comment": "Malware payload (Dridex)", "value": "ba2dac3d28490070cfc240f0f884cdac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776736, "uuid": "5e91b491-468a-4d22-8b5d-8cc3477c6081", "comment": "Malware payload (Dridex)", "value": "8fb997e0c8d5553806303382e7a8efe7756e8340ed23cc21b38afd64ef72e643", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776736, "uuid": "e16131b1-7ba7-4496-8fa1-bb2f543f24fa", "comment": "Malware payload (Dridex)", "value": "2aa9da4f260a32e730baa06451792d4c042095bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776736, "uuid": "a056e9ad-9ff9-46c3-815e-b9b0627fcd50", "comment": "Malware payload (Dridex)", "value": "cf068d7633bf1eaf8123beb9b264bc87b79e2b9a40feb7a9d936530970c9e4c7e1b03a636d77a710522c9514c443ed7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776736, "uuid": "a5cdf809-d199-4b2d-a6d9-6b0c4d4ceaba", "value": "T1C604C090D9EBE5E9E09E5ABA5C7BE23F62685B578720CF5BD364C71CE6A2D4010E1300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776736, "uuid": "ea1a6c05-0ac5-4e94-9f94-0aa62de9fa4d", "value": "1691313ae64e22216ac678d4d81d8bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776736, "uuid": "6006da00-5365-4655-95df-82544668c740", "value": "3072:7JQ6H3ykY88YOSs+k1TwEuTcMIznNuOzlr1Xznku9Luk0eJww8J3a//2uFrSc:gfYOX+wTScR/Xzku9LVwAuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776736, "uuid": "f859036f-fd9a-4474-8166-cd27f36084c2", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776736, "uuid": "50f328cd-4c91-4bf2-8075-6b24cd348dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776736, "uuid": "5f466a1b-73a4-479f-a7ce-a59519908cd8", "value": "ba2dac3d28490070cfc240f0f884cdac.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8ecaf8-fb2f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628746774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746774, "uuid": "fee08a82-614d-48a1-ae67-fd58af44f82c", "comment": "Malware payload (SnakeKeylogger)", "value": "db671e1ec4f71b051a4efe0cac7d09c1", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746774, "uuid": "cdba4c1f-f539-405c-a420-01995d84cbb8", "comment": "Malware payload (SnakeKeylogger)", "value": "8fc18a9ddfc44798d643184b165eb9019ad290d3dc7e81162c9e86759b8e529b", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746774, "uuid": "dc489ab7-fed8-433b-8d78-cd689b9d37d5", "comment": "Malware payload (SnakeKeylogger)", "value": "a31c7dee3d43b4c2fa103999d6ad4c5fca2caf73", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746774, "uuid": "3b1c9cf5-11b2-4005-9930-d9b1763e8096", "comment": "Malware payload (SnakeKeylogger)", "value": "54e1b0ae07a3a33fece4d638f530d407e81d16bab9691cdafd5beaf20fc47a14219acbbeafdaf8dccb2e1601fce52b52", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746774, "uuid": "f7bc1228-e748-4915-ad54-d64d45cc949a", "value": "T14F65BF2E76C04BD4F2720E3DECDDB01076B9BC015A43DE2FAC987629552F6958A3219F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746774, "uuid": "965770ad-fa14-4966-83ea-9697a3fa3ff3", "value": "12288:/kJtPdGVDaHK7zTe++KINAeU+dy7fOhL8sCTqegHCcxvKIHWBSGm:cJYO+VluZL8sCTyHlZdH2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628746774, "uuid": "cbf09348-c91e-4bb4-8f5b-ac6ea3e26a57", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628746774, "uuid": "f0f52615-7369-4676-87e3-749be08a6b7e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746774, "uuid": "e8479927-ca85-46b1-bad0-b6dd2519124c", "value": "QUOTATION URGENT PRODUCTION NEEDED FOR DINTEC ORDER LIST Ref 37470 RFQ PIP001 _scanned from e xerox multifunctional device007_pdp.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b449c8-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628749101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749101, "uuid": "4996cd3b-b18e-4458-834b-d8d3d5ff3f61", "comment": "Malware payload (SnakeKeylogger)", "value": "3aa3e405e6f4f20458dd2574869295da", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749101, "uuid": "7d8ca53a-1233-4e32-a26c-5d09b2edc329", "comment": "Malware payload (SnakeKeylogger)", "value": "908189def01f45fe96acaf13542f702376327b2db1c782c14d877c320b2c7614", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749101, "uuid": "242c5157-7d82-488f-9516-3ef0036ca7b0", "comment": "Malware payload (SnakeKeylogger)", "value": "60c437613fb10e7fd5b4190571ab8b04ded9f1ad", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749101, "uuid": "4c8d59da-424d-4e87-bf67-08563e6d6212", "comment": "Malware payload (SnakeKeylogger)", "value": "c23ab9f8bfbcb20e712a950a469ca96d375739d3ef247271a1661e0e846f80893b0eda03ca1d4f2a5679dd673fb074e3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749101, "uuid": "6c6691e6-6521-4a80-86a8-330fe437efb4", "value": "T16CD3629DC16746988FC1A7B96B2B9F84118C7A6DFB44A532367C633517E2E3B500283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749101, "uuid": "b066cab0-2699-4ac5-be05-ea475ad7fcfa", "value": "192:uDlItrnMHQcSUhRBeVCp3cfDBxdDNQt0yw0u2FKrn:uIrMHFthSVCp3c/dDN370xFKrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749101, "uuid": "d40f4d1f-e734-412a-8a14-06f1a2965ac9", "value": 139612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749101, "uuid": "92b933e3-8b56-4f6c-bb2d-0999e470a34c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749101, "uuid": "3dd66ba3-e900-4d64-aae2-18f6a26b41f3", "value": "TRANSFER VOUCHER456556.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f099083-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628775876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775876, "uuid": "72d95fac-a413-4c03-9b45-b35df822ab6d", "comment": "Malware payload (RaccoonStealer)", "value": "0da43ff2818bd897206bf362ee8aa27f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775876, "uuid": "31f79633-8b03-4129-b52b-d1fcd36ccade", "comment": "Malware payload (RaccoonStealer)", "value": "90ca9c7f8b656d2104a812ce9ba2625c1ab3b6ae346df7e6f01c838bf8990bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775876, "uuid": "9095659c-4738-41bf-bf85-45de05ad307c", "comment": "Malware payload (RaccoonStealer)", "value": "7013151ac5b6e201ebb6f20efff8dd8d269e92e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775876, "uuid": "fff887fa-4b3a-41bf-802d-b92ce11db0e9", "comment": "Malware payload (RaccoonStealer)", "value": "7069ad7aeaccb0ee1931d583aa1efab406611a0dd5004b66c1e0c32f7e0328afe9e6b2c031b2dc7d0bd2ca708fe7d821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775876, "uuid": "24355a66-c16a-4072-8b41-16dc7a79026e", "value": "T14E152363BFE941F2C0A365315881B7A25ABDE2360B254CD777A40A072E321E5FE3D2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775876, "uuid": "8835b5f0-5e51-4f46-a758-625acc726d5b", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775876, "uuid": "b9ecf69a-ffad-4314-b661-4d7e0070eb7b", "value": "24576:o53uhF1ekWz2q28OV0vn0IGFr6s/5iHkNTAskAuQ:o5+hF1CPhOavGFmsB2kN0szuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775876, "uuid": "0e6ff4b1-6881-4d25-97f9-0b995cb3d6e6", "value": 887002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775876, "uuid": "5943b41c-d7ac-4c97-a4a4-eb88de0e6d8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775876, "uuid": "57fda2bd-e924-4155-a698-161488e3eebb", "value": "0da43ff2818bd897206bf362ee8aa27f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72103867-fb02-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628727348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727348, "uuid": "2dc0b8db-fa84-4df3-aa22-4391c918ba7b", "comment": "Malware payload (Mirai)", "value": "76eeb5d8f65e2650756a62c4308db38e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727348, "uuid": "66468cf4-c9ab-4231-96ee-d928747547e3", "comment": "Malware payload (Mirai)", "value": "918bb5b009e992d337db9ccf2b3fad46ee019491dcbe4a6cb750aca62e4c608d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727348, "uuid": "2937a44b-8d8d-4aef-a09b-e1257be37794", "comment": "Malware payload (Mirai)", "value": "d8bd63bd93689a960347d84b68b12482fe84801e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727348, "uuid": "11f777f5-0a5d-463e-9946-0c1a8928d727", "comment": "Malware payload (Mirai)", "value": "d7a7f738b7e5d3e0c39db76fb7427effc4083c55e6eb24e637df837a3b3e4d0287856c97ce18376e7f4af6be3c1a432e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727348, "uuid": "c63b4436-a511-4468-8a14-fdbb0399fb07", "value": "T12093E709BF610FF7E86FCC3709E91B05198C550A22A97B367A34D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727348, "uuid": "14a62d05-15e0-4e45-a351-848a4652b8b3", "value": "1536:nSITUINkErcWGinZnH7zcSAkaI91rFSEZa72PzY:nSITRNsWbtHMibSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628727348, "uuid": "654d2287-bbcc-4471-af58-4e2ba6579fd1", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628727348, "uuid": "3a8d6ee9-48fa-4784-855f-76d83d5ffb8f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727348, "uuid": "ee605a0d-11c4-4e9e-99eb-ae5b7773af94", "value": "76eeb5d8f65e2650756a62c4308db38e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85c0345-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767436, "uuid": "a9d0c71b-bc05-4a95-88c9-e2d2d9dc7e03", "comment": "Malware payload (Nitro)", "value": "63959948baa9eaa4485b0eb2afff6e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767436, "uuid": "8d1df22e-b289-43f9-8307-11d67a0ee036", "comment": "Malware payload (Nitro)", "value": "91c3da96316137cb43f02b9e11d82d07247e9d6eaf8fb8422035c4b9b2b8add0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767436, "uuid": "a22a1593-dbfd-41c1-a98f-0c03269def77", "comment": "Malware payload (Nitro)", "value": "f70971cc1a8352d96d1755e6230327de686814fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767436, "uuid": "8b795ba4-5c2f-4b37-844b-575ec984ec61", "comment": "Malware payload (Nitro)", "value": "b6742edd524b04a4d113ff630082ac64f8b89eed2b0ff595344f60199ff590c9fdec792b9c6811908f61e40894b6deb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767436, "uuid": "d725d844-1feb-4fc2-8a7c-169d1e47a9d3", "value": "T1A053642852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767436, "uuid": "ffc4c87c-aa1e-4b8f-a387-e00470d366ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767436, "uuid": "f5962feb-3433-4212-9bc9-24f15e5f4d30", "value": "768:uKsMqCXfVcWBzM9ZkiANIUMzYLDwUzc80gmq3oP/oD0:uKse5M9ZkiAP7r/0O8/og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767436, "uuid": "1885ee12-2c99-4e44-83ce-41e97773112f", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767436, "uuid": "b6bdd169-81cc-4a28-ad41-eb0ef0d4abb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767436, "uuid": "f7a3181e-2a6c-4f12-8807-2e0e07e1390e", "value": "63959948baa9eaa4485b0eb2afff6e95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e9cd45-fb99-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628792044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628792044, "uuid": "7c168bcd-cf7a-466d-b883-94500e5e2a54", "comment": "Malware payload", "value": "a71df698499d0783c2f89e49a65f36c4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628792044, "uuid": "3e9e71dd-8f62-4d3e-a229-a07b04c9658a", "comment": "Malware payload", "value": "9206f6848b9c59e99ee2a534e9fc987695708c249fedd65dac8b38cbdfd4848d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628792044, "uuid": "69cf1ae7-8edb-4252-9ce4-548c24c6f989", "comment": "Malware payload", "value": "fe40ddf6c8e5d6a808982956513cc9023d75aea4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628792044, "uuid": "f11b8147-aa88-4ba5-a232-a8b46510c604", "comment": "Malware payload", "value": "7883b325ce2644fbfe0c417e0b34616e0d57211d02f89bfed619191c1f050507659b1b2f1cc4173ec0b385133f50ffe7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628792044, "uuid": "b196a48f-18f1-4515-aa0a-7d7c94e26e34", "value": "T1EDA50142F359E827C433C2365A751366601ACD588E47F7972906B7BC6DFFE988E81AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628792044, "uuid": "5df7eaec-643c-4cdc-8699-43dddb6ac95d", "value": "49152:KcmHVErBjCreEd5z40HXKAzlJhy9UzOpLv4tm2Mb:oV0BMXd5MOXKElyP8teb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628792044, "uuid": "0953c161-074f-4da8-a4e2-09e6cafd3551", "value": 2111903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628792044, "uuid": "bc1773fb-5272-4a1f-8b26-7fa4a593c41f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628792044, "uuid": "7eca2469-d2d5-4873-a9c0-41ec1536ff37", "value": "Downloader22.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1129de45-fb6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628772712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772712, "uuid": "1160418d-5678-416e-9156-b6afabca10cb", "comment": "Malware payload (Formbook)", "value": "d5de1d131caf6d485680510898e1d1bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772712, "uuid": "ec290fb1-c7f9-4e4e-9bf6-e8d156c778a2", "comment": "Malware payload (Formbook)", "value": "92c3ce5b263bedf0e55723eff317e03c62586173fed419e4f62f26c19835b4c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772712, "uuid": "f0ab9ccc-3354-4113-888c-2c428cd96284", "comment": "Malware payload (Formbook)", "value": "e0fb9ca230e0723440c43fd208f36f63956d2dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772712, "uuid": "9c324d6c-2863-454a-84a7-23745e316b91", "comment": "Malware payload (Formbook)", "value": "735f9713e2f2d52001289dd4f7426b247a374df60835c8eacef1376de7ea907ae37d475ace21a01b0b54dc9a3b9288b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772712, "uuid": "6d03332a-1930-43d6-96e5-faad1b0369be", "value": "T19654F151BAD98170E4635D3104B8CAB25E7EFC708FAFAD672394212B8F211C19E35E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772712, "uuid": "d319e99d-c609-4001-8d04-95df63423403", "value": "70dc986f89100eba5b0fbf299e1d4ebf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772712, "uuid": "d6d4a70e-b952-4d92-8b4a-ac405354f809", "value": "6144:JaYslR8Np2xRgWoriDZvKO2FXztZe6lUnKkSX9nllhVQoijpWy:JaYslmpOUuvh2LlUKkWllhVQph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628772712, "uuid": "27bdcebe-2656-47bf-8c4e-d42aa325a711", "value": 302803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628772712, "uuid": "3fbf2909-dbd7-4dd9-ae57-63be3d395615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772712, "uuid": "2ca975e9-f259-4857-bb8a-8e1f6b63b7a5", "value": "bbo4001298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfe8a66-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766907, "uuid": "e9f6b86b-7674-4aa1-b7d9-621873af8464", "comment": "Malware payload (Nitro)", "value": "4ae1ea60f3ce403f37b317a9ad21f15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766907, "uuid": "9a306207-66f6-41b1-98fd-a0f1cc108e55", "comment": "Malware payload (Nitro)", "value": "930942fa07b68fbb7ffa8b3ce7f1121b3d576567176ca242721e4be14fb84f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766907, "uuid": "e47c9108-41c5-4ebb-a1b0-295ecda98d73", "comment": "Malware payload (Nitro)", "value": "3b4fe3a2b10c6c8dff5d66ba63a286a7793ddaa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766907, "uuid": "3857eb52-8d5d-403f-a373-8905ca4a0eb7", "comment": "Malware payload (Nitro)", "value": "84818a948593266bce7006e1ed46cd14ce21bee65fe25e0f077453bf5597e4c8941a1cec6d2c442de645f31d7b3e3bbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766907, "uuid": "e79197b9-1d87-472d-a6f7-243b623ea930", "value": "T17E5365286273842EC57C81B811FB2F7C2BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766907, "uuid": "911850ee-a43c-4bf5-8cd5-41547deeb791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766907, "uuid": "995bdf1d-d4c1-4dec-83b7-c2fb21319c6e", "value": "768:JOucKn7n1JSDNANIUdTvLDwUzc80gmq3oP/oDg:JO2SDNAPFr/0O8/o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766907, "uuid": "94f05f7a-c3f2-4724-b76e-39d629cd5d7b", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766907, "uuid": "d566bb73-6206-47cf-92f7-12263b425a94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766907, "uuid": "165bdc00-e862-494a-ba5b-c1e4e81d95ff", "value": "4ae1ea60f3ce403f37b317a9ad21f15a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18711db6-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767571, "uuid": "df868fb7-8f98-4dd7-8b43-6ab48c2bbbfb", "comment": "Malware payload (Nitro)", "value": "c05a1d1890a970d225a8ac5ae746b7ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767571, "uuid": "a4bc1f57-cc25-44eb-8c71-97c7941b4411", "comment": "Malware payload (Nitro)", "value": "93304a2973a26e4b16cf86f88cfbed1138970a3a05886a12fff9ecaae2c64cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767571, "uuid": "9bc491e3-f4f0-42ea-93ce-8574cde99027", "comment": "Malware payload (Nitro)", "value": "b450b5b7a5b51232c2077c97cdcdde48ff8a404e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767571, "uuid": "01a8ca0a-4045-4cf4-93d2-41efa2221add", "comment": "Malware payload (Nitro)", "value": "6f41d46fe2c7e91e23742f81424fabb8432a07e708e388f6f633e3291efd0fb91856169055c318d22d720cec4b7774a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767571, "uuid": "43187888-5c89-46b9-bb34-d451a7983ed8", "value": "T12353542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767571, "uuid": "5660f5f0-40f0-44f9-8d81-0ab5732aa23d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767571, "uuid": "c91453b3-89e7-4574-a717-2c9144caf7e7", "value": "768:sKsMqCXfVcWlvM9ZkiANIUEHYLDwUzc80gmq3oP/oDr:sKseZM9ZkiAPfr/0O8/of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767571, "uuid": "dcd64a11-e39d-43e1-beaf-f61a762f0d27", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767571, "uuid": "a1c1576a-cb85-4dc2-9f39-33dededccfb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767571, "uuid": "fa5b31f3-1612-423d-a17b-7d6b6d6170d9", "value": "c05a1d1890a970d225a8ac5ae746b7ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f18ee20-fb89-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628785191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785191, "uuid": "0421c6f9-e764-44f1-b7f3-cb237326a9d6", "comment": "Malware payload", "value": "60efed97856080207045cff0baef2c82", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785191, "uuid": "baa48a2a-305f-4043-846f-6696ced974a5", "comment": "Malware payload", "value": "938f721ca8dc9da62a4027fa9b43b8f812849b3fcf9ffab4438f951ef93b3418", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785191, "uuid": "65ee8cbb-7b59-45b8-98a9-1f67c740e7e0", "comment": "Malware payload", "value": "0a1b5e1cd3dc3fab6b57eaddc0dcef9730bddd24", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785191, "uuid": "66442b8f-b048-42f6-9609-157d77080731", "comment": "Malware payload", "value": "ac2561860d9e478aad6bec214d2484dc2094a82ff024ceaef3a83a0b92be0a4bf2646c3f1a49a80eead8cfd106e9eebf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785191, "uuid": "59e571a6-a43a-4eed-a547-b885f15c1ef9", "value": "T18BA50142F359EC27C133C17656791232605ACD189E4BFB872906B76C6DFFE988E85AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785191, "uuid": "fa672d09-71e7-4747-9d68-a4a410e7517e", "value": "49152:QL4w6Fgk3N8dYyEMlJsfeLlr0HJv0Mfa55OpLv4tmc4I:au4YnMlJuqlruvD8tMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628785191, "uuid": "691734cd-714c-4af1-acd4-39b85fd25c75", "value": 2111811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628785191, "uuid": "a8ecb173-992b-401f-bac3-0119313db863", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785191, "uuid": "6c05533d-6996-4c26-9dfe-546ad3887007", "value": "Download.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7595a7d-fb36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628749825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749825, "uuid": "fee494df-484c-4413-85a1-5033acbe06e2", "comment": "Malware payload (SnakeKeylogger)", "value": "f5ca8f415aea09611a9aa9d3c6bd1a2c", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749825, "uuid": "ba3c2c67-ccba-4b30-8f59-70e0428fe95e", "comment": "Malware payload (SnakeKeylogger)", "value": "93e4528267157334ef0d55c3f378ce7f862c00d7c49a9215d8a7426188dda454", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749825, "uuid": "bf53b9df-3c65-4a01-8958-df7168f5617a", "comment": "Malware payload (SnakeKeylogger)", "value": "438276787f950bf79393b0903883fff232684e76", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749825, "uuid": "553091cc-303e-431e-8e8d-cabca58e9e0a", "comment": "Malware payload (SnakeKeylogger)", "value": "0ddc71b35c06fe213a05e2daffeaeed4dccb3717e0e1ec4de6c617d4aaac891b70e6be8fc50b66200cb99b7f1427f4cd", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749825, "uuid": "62e83f45-01ec-4f20-8b83-56c87de9e6a9", "value": "T12595B33C29B92627D07AD375CBE59927F4409CAF3161BD94A4CA73660372B5239C323E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749825, "uuid": "62d9e7e0-0461-441a-9410-ab07e2abe0dd", "value": "12288:WC3hpINYoA3P1/GyjcOgHf4uvP9H539XKfalV7T2fXOk/HmUVppUuEVCHo:WCTIN7EZVjcZHf4YbN6UV7T2fXOvOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749825, "uuid": "57d6598b-cb12-4433-b544-cfe8d71ecb17", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749825, "uuid": "366886a1-82e1-48cf-92ce-626792517729", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749825, "uuid": "b882dbc5-6b50-4088-a833-cb60c99e7954", "value": "BE-IZ-Q-1278-21 - TECHNICAL.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19422f1-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749359, "uuid": "bd126d95-90ec-4a9a-97cb-5d15b7ce8a90", "comment": "Malware payload (AgentTesla)", "value": "f20d694b18d4f2bb02f54ac2fb8044c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749359, "uuid": "28b12025-4cd2-44e2-a995-75099e608273", "comment": "Malware payload (AgentTesla)", "value": "94be2052e010ce629cf1d83cead45985d098287dbe4836c7cc5c23feeae595e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749359, "uuid": "bca0917c-fb89-4200-9ce5-91f706d2aeaa", "comment": "Malware payload (AgentTesla)", "value": "ecb05dd077b82c4042afa46a9a42f58f430c0ece", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749359, "uuid": "887cfa30-d92a-4063-ab91-c8bba8770c9f", "comment": "Malware payload (AgentTesla)", "value": "46b2357f7193b03f54a8ddcdd88a5b4d5d30755329f0d360c2d7ab81757d82b1edf44f477c6afb6cc9dc1c8bcbe6a2a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749359, "uuid": "6b57d880-aed8-458a-9c34-646e4ccd82d1", "value": "T1D7E433B3669F9F19D3B3BC3D1980B8257654D9C6FB82E90CD467EDA4CE1304086139BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749359, "uuid": "0a03ec5d-65e3-40ef-b6d0-4a8eb718a5b9", "value": "12288:sGqEd59EI4cwd1+FJcCgOeDRCarmK6tpEc2FUzMqVLIEi5ghWhGlVjOzST8WdZ:sG5FQ1CgOeDojK6tzhVLIEkj07OOT8IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749359, "uuid": "daf5e485-d460-422e-889d-8f2d00f4be34", "value": 697906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749359, "uuid": "5f4b0034-50e3-4203-80e6-49e92b68ba81", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749359, "uuid": "f7983314-e4b0-4fb6-b98a-5508ae724bb9", "value": "revised_order 653525256.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52afccd-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767404, "uuid": "96a10094-c14a-4697-917d-864576e0009e", "comment": "Malware payload (Nitro)", "value": "0315343bef82cd015982aa6bc6216766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767404, "uuid": "c3a87c22-ed49-4461-9e06-484ea3987874", "comment": "Malware payload (Nitro)", "value": "94bf87096d781c42f001d6eb32d21efab0a73d0c9680bb30a525a346fa7e78c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767404, "uuid": "20b8f411-82ad-4283-a6c2-2274424e6ac1", "comment": "Malware payload (Nitro)", "value": "89176a117d54949668fad16bd0efe99525e03bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767404, "uuid": "976bb720-7689-45d3-aabd-fe8c3ce6852f", "comment": "Malware payload (Nitro)", "value": "a81771eab531d8c8e79235ff712a7d387ce756ee834aa7ad6842ca3019825fc28ba3bde650f23e3c3d45d6dd869d0123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767404, "uuid": "664bf82a-5707-4cca-8192-3ec49e49a5fe", "value": "T15353542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767404, "uuid": "5c0cf67d-56c0-47a6-9c25-09a38c647dd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767404, "uuid": "6c86ed02-52d0-4118-8e45-d28c685c43ed", "value": "768:lKsMqCXfVcWlQM9Zk4ANIULIQLDwUzc80gmq3oP/oDyt:lKseSM9Zk4APtr/0O8/oWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767404, "uuid": "04352f9c-60bf-4927-a44e-d271dd584151", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767404, "uuid": "d43d584a-b053-4157-90c4-334114ec4d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767404, "uuid": "3cdb6fbc-0fe2-4f31-ada6-7f3f1ae65d89", "value": "0315343bef82cd015982aa6bc6216766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e88b826-fbc2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628809886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628809886, "uuid": "2f73f1c0-803e-4587-82ce-62fc32173bbc", "comment": "Malware payload", "value": "bfbc4e524ead489dcd8939c17bba7071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628809886, "uuid": "8f2e473f-7b3c-47f7-be42-0d0bafb82014", "comment": "Malware payload", "value": "9519d8fd2da2a5e3c3ffa2a490c851946da030910c91ce2db392c9aa464bdd5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628809886, "uuid": "bf273c22-5159-4fab-91d4-ae92d1d467ea", "comment": "Malware payload", "value": "bedeb2120fb36b78edbbce09e3978d2f83d1a1f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628809886, "uuid": "6f623fb7-fb4c-43da-a2e6-8284913771f8", "comment": "Malware payload", "value": "e6b5fca25180a89201d9596ef7de86a76c29fdc0a0c678dc50d3983dbea9bd9421cfec8d2d1755a7994fc425efe16189", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628809886, "uuid": "3b07a344-8298-439c-9844-f62da92fee5d", "value": "T14FD412DCA7194515EEB26E3E25EBE714322BAEA1FD477103228437C96833BD4359242E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628809886, "uuid": "f472e339-d244-4540-b4bd-e1b4ef529275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628809886, "uuid": "1df46503-7270-4824-a6aa-15973979dee4", "value": "12288:nqet5SET9Q+IYuH+Drufmde5P1yLvMS3UYtBnm0FwJsNkEfOae+GGI4Wg:nqiUETu+bDrufmdeVWNkYrmSwiNkEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628809886, "uuid": "1df84da5-3a0c-4123-bb6b-ca5f99ca78b0", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628809886, "uuid": "d47dce5d-9c6d-4fc0-bdee-5ea24bf3e192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628809886, "uuid": "561779de-9d93-4cce-953f-6d61356a174f", "value": "bfbc4e524ead489dcd8939c17bba7071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069e45ed-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628756374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756374, "uuid": "dbe601ea-7ef4-4fb2-8e1c-42a36c58447f", "comment": "Malware payload (Loki)", "value": "523f34d0857746c5fd3bd5de613c6f3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756374, "uuid": "f812b711-858b-417b-9947-b8eb230971b5", "comment": "Malware payload (Loki)", "value": "955d472c00f8c3366e8301d35dba29622ee8de670fd29320cea50853b8c7a60e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756374, "uuid": "3e6b60de-be15-4067-8a6c-473e2c7ac0c3", "comment": "Malware payload (Loki)", "value": "e6165ca2d2faf4a8ab66af56af2dc4594da7ebd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756374, "uuid": "b1f583e9-ff5d-481f-903f-4a402166b851", "comment": "Malware payload (Loki)", "value": "95ef18769c1b29f7e06855440477d02aaf617aa2ed19c658987e206a112e59a9d81fe49169e189c4a5ab4cbc6dca58d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756374, "uuid": "593c620e-adf8-4a75-9d0c-9f4191a8cd0a", "value": "T13155A23C29BA2627D076D375CBE59827F4509CAF3161BD94A4CA73260376B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756374, "uuid": "44ced6ea-7d96-4d59-a194-bd3c42d5b9e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756374, "uuid": "7de7ad58-affb-4b2e-80aa-4252d5eb4382", "value": "24576:QfQB17OOXg3ji58haakJZuJYkCLT2fXKvOF:gQBROOXgW5IdkJueLT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756374, "uuid": "4a427a4b-631f-4f16-bf79-59a0c5d31e97", "value": 1347072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756374, "uuid": "d3c376cd-2404-4cf5-a801-a5854fb80690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756374, "uuid": "5cbadc80-5227-4682-b926-270bd9ea1d7b", "value": "523f34d0857746c5fd3bd5de613c6f3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5780514d-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767247, "uuid": "8569a394-fef1-4318-b7ca-2400aec0c5eb", "comment": "Malware payload (Nitro)", "value": "168d8c8c116edf07cef3a524e4802375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767247, "uuid": "aad55df2-0ea3-47e6-8e1f-b9c33df07a30", "comment": "Malware payload (Nitro)", "value": "9635d1f6bacc4b9c882106cd1fe14beeb0783cdf13bc9a69288abbcb67bb8287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767247, "uuid": "de5ee95a-85de-4244-958b-395ce3d12c1a", "comment": "Malware payload (Nitro)", "value": "8e056d0a8859311e5d8ea2f1baa389a79e6feca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767247, "uuid": "335425d2-219a-4751-a6fe-415c81b740f9", "comment": "Malware payload (Nitro)", "value": "860dff99d1a70ab5810a42355a961fc6ccb83c52a56eaf41de6e7b4312a77b02a0e7029b2d423ecab228720564bd9e61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767247, "uuid": "787e28f1-c647-4c57-9c07-b5f6b4434cb9", "value": "T1445365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767247, "uuid": "a12f12d4-4e2a-419f-8713-b0daa638f6d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767247, "uuid": "d2f81912-35a4-4b32-846d-42c19248b198", "value": "768:mOucKn7n1JGDNANIUKtuvLDwUzc80gmq3oP/oDl:mO2GDNAP7r/0O8/op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767247, "uuid": "834af298-e27a-4a23-9bde-dde719cd5f35", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767247, "uuid": "f4548d32-d124-4852-91c5-c75a93a7e32e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767247, "uuid": "728e34a7-6f48-4070-8f3a-d168b522ad19", "value": "168d8c8c116edf07cef3a524e4802375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e326021-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628749246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749246, "uuid": "445fcdbb-c83a-47c5-b932-9f06384fd2a1", "comment": "Malware payload", "value": "cd74bebddc7ec4abba0164c644736a3f", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749246, "uuid": "ff5c7d11-13fe-4724-81cc-b4628f0aff2e", "comment": "Malware payload", "value": "96c9bd911342e2fd8b3cbb6d270eed7afa967470054d1b4e151da5d726fac3a2", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749246, "uuid": "68c10a9c-f2b8-4cfa-b55a-e399aa789c8c", "comment": "Malware payload", "value": "2842c4345149a3cbc64ef30dee11dc153b71e7cf", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749246, "uuid": "e2323e89-95ea-45d3-b90c-c96c59eba623", "comment": "Malware payload", "value": "b30a6bd7e5888448e6a6a6c586b414ac8830e7f34a67b3dba3f67f09c46e12beff20d25ddb7c884772e983376efb484e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749246, "uuid": "61644951-bbac-469a-9359-3cd60ff120f7", "value": "T1475512C1DAC6B939D5BEB17CD0924A31D1C8AD9369EF9891F3CCB6C0DA715B1838812D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749246, "uuid": "07ffbf6f-afd1-4a63-9374-9390f0ed145a", "value": "24576:h0p/kttTKxBVBchX84HAwktZZYZpPMBRlmLTk0a5jWWt8qrQ7tQ76JbaDu7i7Niy:h0lNJAAVoKjMLTut+Q0i7WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749246, "uuid": "47fa6659-c4a5-4948-8644-7a2e739c0249", "value": 1320488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749246, "uuid": "e12d258a-1907-4c3c-95d4-f9adb81c0ec2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749246, "uuid": "bdc2be43-e4a3-4bce-b518-039aef0901b3", "value": "New-Order 11-8-21.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bfbc1d-fb33-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628748339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748339, "uuid": "0bbf2cbf-5da1-4d74-9254-1b40eb4fe887", "comment": "Malware payload (AgentTesla)", "value": "577dc6394a38a33b0cd9d49eec5924a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748339, "uuid": "467267d2-b564-4da7-b2fe-ff8fb670d4c8", "comment": "Malware payload (AgentTesla)", "value": "980bd7ff23791ebb952401b52a23919012562b390af038762e0c3a188241b4f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748339, "uuid": "ae6064ce-8f37-4cce-98af-62c6c089740b", "comment": "Malware payload (AgentTesla)", "value": "0a2f64a3775c19f0fcbb7e187909e5b026632125", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748339, "uuid": "7faae805-0d9c-4bcf-9f37-cccfffe7b4eb", "comment": "Malware payload (AgentTesla)", "value": "e4bc677c221cf978a7f08eafcac1a827e61bdae3a81b4d2283cb0054ce8a82d6567385c4e56137d8e275992fe35b6cc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748339, "uuid": "0ff0d401-2f83-4bd7-a986-898d660cc99c", "value": "T16925D09D72A072EFD817C976DEA41C60EA65B4B7871BC207901701ADDE0E987DF206F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748339, "uuid": "eb3ece91-b5bf-424e-a5a4-18273f4a6e3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748339, "uuid": "24ca8e81-a6b4-4443-ba22-9c542a5a9be8", "value": "12288:R/HK7zJskOPsHMeHfErUXg1sgRevgCXLDkqIA3CNNiwnqWJ4eOaao0kwtihyTEhM:4NosQrJ1TRbSLDkqTSyzfk3xyTHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748339, "uuid": "8e8d1cd3-41f4-4012-9f99-1bf2e7688687", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748339, "uuid": "6cbe5346-9ca3-4200-851c-8e471ae87aaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748339, "uuid": "053c9589-6bde-4b5a-b332-f1ea3b4f4ee8", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff777eb-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628776468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776468, "uuid": "0c6ed9ad-d61a-48f5-b5a3-9a36cf6a5213", "comment": "Malware payload", "value": "736669d5d1dfa12937b76e6710152f68", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776468, "uuid": "ea7bdcaf-2053-42e7-861f-096536660e3d", "comment": "Malware payload", "value": "98ca9e1847d490b88b302a2ac2194c96edc593a3a1c7328b137deedb68dc1b8a", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776468, "uuid": "661d9797-d901-421b-888c-396a8d13f650", "comment": "Malware payload", "value": "7b4196619611f520700cae041118c09f3b397e6e", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776468, "uuid": "bb206077-c8c9-407c-8dc0-51f242211cf1", "comment": "Malware payload", "value": "135df4882b9d099d89842bdb29e75a372a0c14ef7e842927adad0240bcdf28e50d38fabd0e4833ad887bdf4d3ba32797", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776468, "uuid": "d16b1375-e58b-41d3-a2fe-463f003c2f77", "value": "T13DF05C64DF7861D6C418123AC143DF0C0CA1A08D8080D7357347F10D56E48C0AB8E5A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776468, "uuid": "82d27698-1413-409d-b413-d093b980d824", "value": "12:8rfl3OB+Dh4dWfgzrxRgqa9WJSQsMXr41OUeXz98+R:8HDhLIwp8Xr4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776468, "uuid": "c8b08858-7519-4ec0-bf5b-430b5d8165fd", "value": 534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776468, "uuid": "5006488f-1378-43de-8a87-2731985e2fa8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776468, "uuid": "afd8551a-a127-4faa-aca2-da34f3b5e5c9", "value": "banload.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749b666b-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767725, "uuid": "33bfb0fb-8ef1-40a0-b946-3587a485ba34", "comment": "Malware payload (Nitro)", "value": "f1286a648e6432cb928e78202c1ded17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767725, "uuid": "fff4516f-fd09-490c-a6a7-fba45d38e8bd", "comment": "Malware payload (Nitro)", "value": "9952e1a0dab320a2a2a3f9f96fe72b5972db128d6c0f7595682d70cd5acb888d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767725, "uuid": "a765e5d2-02b6-4b54-8509-eb2c1e6b915b", "comment": "Malware payload (Nitro)", "value": "d3350d4dc2cd1dce2b383bcfc72f0ba0664eef9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767725, "uuid": "25eed1c4-80d5-4db9-ab61-4ec77508dfee", "comment": "Malware payload (Nitro)", "value": "181d79fe3ed21af499e824053a3ce930f3e7736390a10367f6d7de33ad13e93e00d0608afb6a9c9d947f65fab3d75cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767725, "uuid": "89dd2de7-f863-4949-b459-8b3675e8e1a7", "value": "T15053322851738A2DC86C92B815FB2F7C27B0AF166460C75D4A78D2AC3F277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767725, "uuid": "1acecca2-584f-4d0e-8f43-03b37599c7a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767725, "uuid": "c0739af8-e308-430a-a36b-3dbc3d58498e", "value": "768:ut4jUTTXo/iqo811boGNIfcAYLDwUzc80gmq3oP/oD6:ut8HDoGi+r/0O8/o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767725, "uuid": "583f2b98-7e3c-4420-82b2-a11886445e71", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767725, "uuid": "0ebc8e7d-3f81-4400-a0da-22b2fb62f27f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767725, "uuid": "e50ce70b-509d-41cc-9654-896c889b23c3", "value": "f1286a648e6432cb928e78202c1ded17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a97621-fb2d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628745747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628745747, "uuid": "e87c69b5-3e1b-43a5-8669-bd683b13e5e0", "comment": "Malware payload (Loki)", "value": "77e6678e0b0de0f8c2cc6b0d65ee5de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628745747, "uuid": "c42262b7-6836-4532-b8be-d764dcbb4989", "comment": "Malware payload (Loki)", "value": "995bffd2446e01cf7817573adfc1ecf40679b37ffce1640969352ddca313c346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628745747, "uuid": "cca234e3-f68a-493a-a094-dc335c7bc88d", "comment": "Malware payload (Loki)", "value": "4dee777adb8bc96ba4d2f85f626d966f9ac0cef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628745747, "uuid": "97c23c86-f2f7-4acb-ac3d-3cee192c1460", "comment": "Malware payload (Loki)", "value": "543897ac53ad2298c90f1fecd3fad29ec6eb6c899d565f03d0243d1d9b21063d1f82674e18e4651a0d9217795d275fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628745747, "uuid": "bcee65e3-277e-4d2f-8536-a47c2924768f", "value": "T1DB54F013F2E4CA65E0B2683140B845B29A3FD8300E6BDD771358576A9F74AC0C57AE7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628745747, "uuid": "77829d41-6e7f-44cf-8188-7e85374f682f", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628745747, "uuid": "a704ed95-80fc-49f3-a3a9-7e17b596fabc", "value": "6144:ViTRiOnJgC7IUPXXqr9kTmiscgC2wk92FKP/VbxAJjPh:ViTRLJzarZ00/VbWJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628745747, "uuid": "fe5d093c-2d58-42e2-b478-20eeeef61270", "value": 303697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628745747, "uuid": "87f86163-e3eb-4805-94e3-bb4dc1defc45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628745747, "uuid": "29446598-b846-4e50-8ecf-5fb2f02dfa3b", "value": "INVOICEEXE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2ab19e-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766795, "uuid": "e0fd440a-f385-4a74-8204-b560437585f7", "comment": "Malware payload (Nitro)", "value": "0a8f7774e2ad53ad4add3deb49b4feac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766795, "uuid": "cdc3bae5-3280-4fe2-939d-ffe690fda5ed", "comment": "Malware payload (Nitro)", "value": "99842bf8db6403f3ff467e932aa1b9830523d9b53f15ea2ea71710b30c7884f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766795, "uuid": "f5fd0285-bf26-49d1-8846-7e30f874f8ae", "comment": "Malware payload (Nitro)", "value": "98577cb3dade5d8e8108ba4b3ce9cb862e9e2576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766795, "uuid": "7ab4e941-8329-4b8c-999d-1c4de4fe386a", "comment": "Malware payload (Nitro)", "value": "02936ce035ef93c604549da1b2b8514d18da5243eae91b3009742321ea0b25c114b3086184a86fbf64ed07c5cb69bd8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766795, "uuid": "ba229bff-01d2-42e5-9382-46357f9864ea", "value": "T18D5365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766795, "uuid": "05154f6b-362f-460a-a050-b54b2794639f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766795, "uuid": "205056d5-cbd1-4beb-9acb-53982eec3fbe", "value": "768:FOucKn7n1JwDNANIUMTvLDwUzc80gmq3oP/oDp:FO2wDNAPGr/0O8/o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766795, "uuid": "4673bae9-c84f-4119-aaa5-8a60b42cdad4", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766795, "uuid": "b8340a30-fad4-41ad-8925-a0fe63666137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766795, "uuid": "265a8eef-1a9d-49cd-b555-d30ce5e005e8", "value": "0a8f7774e2ad53ad4add3deb49b4feac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631b193c-fb10-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733336, "uuid": "d2c8eb47-62cf-49e3-8cc7-d5ffca0534b0", "comment": "Malware payload (Mirai)", "value": "79413a0f23f5a51dda67cb7e37310489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733336, "uuid": "abd99e0a-8d21-427e-b069-35f89dc2c1fd", "comment": "Malware payload (Mirai)", "value": "9b000a455a2db6edaea5647f18f1b2ffa9cbd717cbe5bc1f11adedb153dd42fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733336, "uuid": "b35a249f-e2d6-4940-aeda-f600cc4bba6e", "comment": "Malware payload (Mirai)", "value": "18583a2560f31a18fc6a1459d8f5fc4adb594d69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733336, "uuid": "c7a92f4b-ede3-4ab2-aa91-5b994a2f1aae", "comment": "Malware payload (Mirai)", "value": "d77e0e70888d6ff05ea622c265d18181922a9904e08914586ff0b76a7ffc5bcdd17b3a4d01d1d215ad20c5c7d962437f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733336, "uuid": "5e5e4879-2c8a-4735-b9d1-2d9256b5e3e5", "value": "T103336DC6D983DDF9EC15453130679F3186B6E5BF3064EA87C7A9A932EE02A42D10738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733336, "uuid": "b3ec4292-6d2d-4dde-90ed-468f713630f3", "value": "768:5UvnhWLbV7hL9bqSH87mAJKULVqfo9KhyhxY/0zvxIGh:56sV7hLUI8SArKkw/0zv+Gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733336, "uuid": "bdd8b9a0-d0bd-4b6f-87e3-e2e6569102cc", "value": 50940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733336, "uuid": "69ac0578-2d02-4405-9e51-1389cf683e48", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733336, "uuid": "822f9e5e-38b3-4117-8fa4-65b77b8654d6", "value": "79413a0f23f5a51dda67cb7e37310489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a9c0d3-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766819, "uuid": "96790074-8755-48c3-b0be-fdb6337848e0", "comment": "Malware payload (Nitro)", "value": "1babc06ec6bbc0ad240dd51123442098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766819, "uuid": "939cc458-0207-442b-9843-bf672cf6ce03", "comment": "Malware payload (Nitro)", "value": "9b089de469071b5a85d9e43d842bee4ef09a50e1aba0fb7b73d38457fdeb2450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766819, "uuid": "3a910902-43ce-457e-b174-130dc8451e6f", "comment": "Malware payload (Nitro)", "value": "ee52931f9f14833c0c28d8ccd947434924d61961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766819, "uuid": "17e5b8d6-66cd-452b-a7f0-6a1463a714b9", "comment": "Malware payload (Nitro)", "value": "c3cbced316d46e43eb2b8149f1fdbcb82051f9a15107080c40228bfaaf94808dfc9f9758d94ecad5a8a0b7e0e6397acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766819, "uuid": "6de9759b-7b07-40bb-a567-d0406d65217c", "value": "T11853542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766819, "uuid": "b6742842-51ec-42c9-a252-f1cc09d7fe8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766819, "uuid": "c8dcd125-9d95-4983-9d69-a49c69081d9a", "value": "768:gKsMqCXfVcWrqM9ZkiANIUbTYLDwUzc80gmq3oP/oDx:gKse2M9ZkiAP4r/0O8/ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766819, "uuid": "321463d7-8413-4773-9929-91e7d712169f", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766819, "uuid": "3e613d48-5ca1-4478-90ec-94c0e05961e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766819, "uuid": "56345dd9-7bc2-45a8-aa22-8ba956cb819b", "value": "1babc06ec6bbc0ad240dd51123442098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063295b9-fb27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628743059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743059, "uuid": "2279d2ae-7f8a-4977-82e7-39c3141d561d", "comment": "Malware payload (Loki)", "value": "329693bf1fce73c334b98dedce191db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743059, "uuid": "94eae75d-265d-4b8e-b301-256bf2acd8fb", "comment": "Malware payload (Loki)", "value": "9b83e59783b63981f9f85b2939e038531deb96457d91d5d8debc93f396a15272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743059, "uuid": "37f99157-91c7-4d7f-84e9-a63bf7020fc7", "comment": "Malware payload (Loki)", "value": "ddbe13525a6643bc94249079cbd66c00f41235b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743059, "uuid": "12ba221b-30c0-4f10-9d87-db6adec059f4", "comment": "Malware payload (Loki)", "value": "6ee3586e387ed876c1ec3f2c49f3eff38ae3ddb6840c172558af4c69c65cc16a6c06cdf3f5615750555e7f2ca9114326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743059, "uuid": "340d1019-b752-42b0-b39b-8f3aa94a84c6", "value": "T1EC84BEA9F3745CA5E416817E9876E8341137BE5EA52B480E365E322D49B33C210F7F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743059, "uuid": "8e657e71-efc5-4e80-a509-8714f3127cbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743059, "uuid": "ab4d1606-2995-4ea1-bba6-a032b69794e9", "value": "6144:1Tz+HNEq6x2VsOV2tL82F+a6944un6jvgD00B4pC035Ko0TZCjmRx:FyHyx2VsO2L82Qa697un4oBMJKlCSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743059, "uuid": "180d3014-ef1a-4b7b-8585-468c8365e7a8", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743059, "uuid": "8d9a95eb-8e89-4e71-b8b4-cd9dd8a2c101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743059, "uuid": "3e34ce81-102d-4fa3-9b85-74fc379367e9", "value": "ConsoleApp2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d4fb83-fb3f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628753450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753450, "uuid": "86fc89cf-6fb9-4fd1-83b4-fecc7f99ab64", "comment": "Malware payload (Loki)", "value": "af533ffcb3bdce014ddf8e991ddc0dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753450, "uuid": "a82aa477-f534-46f1-915d-2c24db1ed8ca", "comment": "Malware payload (Loki)", "value": "9bdb2adacff9530fde8a0b020e84188b0b39995db62ba167608d8e2493bd3ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753450, "uuid": "c39b64e6-8314-4a5b-b12b-13e0be843493", "comment": "Malware payload (Loki)", "value": "407327255cd3db231a33de98d62baae2e5c31a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753450, "uuid": "0bb04fae-801a-40d7-b7e6-e9a3146eb3d9", "comment": "Malware payload (Loki)", "value": "dd098d8319f74dc3e60c5f5dec2c1783df3879d33c672b049f2bdab42a2f92587e0863531d0554a3a40eaf9dab04297c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753450, "uuid": "4ca3dde1-54b9-4291-b5a2-132cf31cf231", "value": "T157E38D3377C1844AE115CB7190F20A9C4F68FC5744491E0B2B21EF4FA9F9A36E4E769A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753450, "uuid": "67b10dc6-97c7-4bab-8415-ffa79bac4174", "value": "59e6745bf35b42f470b21adfbf2b29c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753450, "uuid": "442141a8-af6f-44b6-a32d-ca7641fee87c", "value": "3072:yxEJpxEqxE2wz/IqR3eQBtCkOlRrw9xEAxEKxEJ:IEJ7EAE2cNRuQBA6EmEgEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628753450, "uuid": "6f1ef737-6a89-4271-b923-e49181aa2d9d", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628753450, "uuid": "489282af-19bd-4917-b364-18876cfaae6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753450, "uuid": "4d903ec2-f11c-4300-8fff-8c0845714291", "value": "REQUEST FOR A TENDER 12-08-2021 \u00b7 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de3a44b-fb29-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628744038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744038, "uuid": "cc89e7b0-940e-4521-9518-7bee515e1125", "comment": "Malware payload (AgentTesla)", "value": "74b71de3732d2b4f3981050fbcff8492", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744038, "uuid": "e4f65dd0-0bd4-4934-b179-8faa6f8e6559", "comment": "Malware payload (AgentTesla)", "value": "9bde6c963b90321d078b877c902285ec2c277cd21662f3db242464bdac368c97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744038, "uuid": "4905ebd6-3794-4d16-880f-d9a2e0f3cae8", "comment": "Malware payload (AgentTesla)", "value": "827d3cfa56785ae393f427e203f7bc69282de4d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744038, "uuid": "9ba878df-fbfc-4fd3-9ae8-a4f340d011f1", "comment": "Malware payload (AgentTesla)", "value": "a9b70339b4f0286271b3b9422434edd408f7ea056c7b775473b383a7655791ead5c48e8582e3ede90d3ac24bf5d56e88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744038, "uuid": "6c7ad0c5-e977-4dd7-ae57-30e3e9c6335c", "value": "T148E4024017E81B6AF4BE6FB95A55605103FBE18B9F33D91E6EC124EE0E27F008762716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744038, "uuid": "460273f1-0d1c-4e4c-97be-3a0827223f88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744038, "uuid": "77a69be1-11ef-484f-a123-23024157059c", "value": "12288:bz+B/HK7z9O4TCmB7ZVqvsCKeruDY1hSJVPe5PdzZGYirmWAN9acXzYj7qXhFVYc:BIPEysCNaXne5Pd9JirmXN9acXUcic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628744038, "uuid": "c7178329-a1e7-4de0-8013-aa44e218b860", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628744038, "uuid": "5531b606-707b-42a6-a4eb-cd6efcc91bf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744038, "uuid": "1ce1b976-fe14-4c43-bf75-2a0d7c8d8f32", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ae309e-fb0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733077, "uuid": "356fde52-5d79-4364-9a26-b92df4bd282b", "comment": "Malware payload (Mirai)", "value": "f78ad5ce3c52b189049d912f5b0732f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733077, "uuid": "6def9585-e4a6-4977-8d7b-76131a57d203", "comment": "Malware payload (Mirai)", "value": "9c9587430f761cf6f5760659f95b36c82b47a12d87d8f1fdecc4dc26f5ca6a12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733077, "uuid": "6c799060-3886-4a46-aedd-35ab9e5a46c0", "comment": "Malware payload (Mirai)", "value": "51dcf3386ba2ce331993860bdf0d27738f7eb935", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733077, "uuid": "66aed95b-36ad-45b0-8217-180e303a9458", "comment": "Malware payload (Mirai)", "value": "227db0ec69e8d1e3195bf1e4ee67d930625129e7b999207422606c66aecb4112a8d483d6b6a4655c061133f7b57b4724", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733077, "uuid": "fa3b1ef6-6196-4903-85e4-890d3f031bb1", "value": "T12573734D3E319F6CFBAD863487B74E21964923D536E1C584D29CEA011E7034E742FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733077, "uuid": "bf10b20e-deca-4db5-91c7-795be0bbef84", "value": "1536:FPKCx03isStClt/AYrCyxMF5AzzEMFhhiz8k2Il/H4kqzSKh4ZjY0t:FyCS3BSonrCyxMF5AHml/H4kqzSKh49Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733077, "uuid": "e1719305-8da8-482a-947b-88c4ac9fa854", "value": 76056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733077, "uuid": "3b5da26d-7681-4f8c-af3d-e762401b199e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733077, "uuid": "caaf4dc3-8204-4764-bdb5-546bdf4f0298", "value": "f78ad5ce3c52b189049d912f5b0732f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008b693f-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628750351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750351, "uuid": "22ea2dfc-f857-4720-a9ee-bd88f34575dc", "comment": "Malware payload (Loki)", "value": "cd38c2cca614bcb2eb9b46e3ff71f7cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750351, "uuid": "fa98d494-041e-4eb8-a607-8e15fdc2b3e0", "comment": "Malware payload (Loki)", "value": "9cfcfd5f81ea95875ce4438ed4f4d8fcc58de169a4acec36af3005b9fd3614cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750351, "uuid": "3364261f-d8e1-4b54-98a3-8861e6bab3cb", "comment": "Malware payload (Loki)", "value": "f1331da710e8113c5bf156175e70d8673e4f42d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750351, "uuid": "bdbadc71-356a-43b0-9504-1975e4f6f38f", "comment": "Malware payload (Loki)", "value": "7535d0fedd9a4884604c212dc5977a335262667e17ec05d27b4ed0aac2504cf446c9eddf8c31f0d2344117b26bdce64e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750351, "uuid": "ce79ae9b-2e5b-4596-b246-b9f841a08cb8", "value": "T190F4BEAD769476EFC967C972CE641C60EB61B47B831BC207901701AD9E0E98BCF146F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750351, "uuid": "18ab0101-f6e4-41c2-ac07-96d22bdcb6fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750351, "uuid": "c2bfc6eb-26c2-4ab6-a82f-a5ad8959a949", "value": "12288:wlWDO/HK7zKNdEVg/fcrMeikoFpHtf9Qm5gIinF9Ddp1DmXzfomR20EidO1xMn1w:DDJaEVg/fcrekoFBVamWIinF9DdpOzf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750351, "uuid": "bc693e69-524e-4a21-8d8b-d766412deac6", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750351, "uuid": "69df263d-1874-476d-8e4a-de004b714f9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750351, "uuid": "df38f5b2-4c82-4584-9a64-e56d7137e129", "value": "cd38c2cca614bcb2eb9b46e3ff71f7cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654ded76-fb10-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733340, "uuid": "3f83052d-15f4-4ed3-8bdd-5f3ee355500e", "comment": "Malware payload (Mirai)", "value": "dd3a9aa741269b36e8127c368ed6bb7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733340, "uuid": "df63f0df-aacf-4c41-a0af-5bb21f5cfaed", "comment": "Malware payload (Mirai)", "value": "9d47a7270f7497be82cf71f8681eaff15eb2919b9eadbb9fd1d82d8d75a3596d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733340, "uuid": "f6cfcb59-92fe-4d88-a1e0-6bc8c71809d9", "comment": "Malware payload (Mirai)", "value": "cc76db4e35d38fc6a8ebded4b3c45144624e18e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733340, "uuid": "6defb511-6b98-4d2b-aff7-593f1112e40a", "comment": "Malware payload (Mirai)", "value": "e93324cdc7cd2b9ff2fae865b331961a60daa0d7e141159f58d985bb5acde57a6ccac62857a40ec8d240c2532508b02d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733340, "uuid": "44f6349b-101c-4905-aaab-0f9f1ce62110", "value": "T14F536C21AD792D17C0E8A5BB52F38324B1F5574E25A4CB2E7D620F8DFF50A4012672FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733340, "uuid": "d2b167d9-fa8c-4978-b453-0622d8142716", "value": "768:57BuVCKkYoesf1PjmMKr3+rbSQMarrm9JR9aEO+3HN6kGlEJNSGjR:JBucKkYANPXKru1Mh5ae3N6lEJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733340, "uuid": "f89b53e0-0a32-49e9-a938-918a248062b2", "value": 60796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733340, "uuid": "22620d57-0574-427a-8d12-2a611a330c1b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733340, "uuid": "881dbc0f-4131-467d-b2f3-3c2c12bda30a", "value": "dd3a9aa741269b36e8127c368ed6bb7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aebc15a-fb3f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628753589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753589, "uuid": "92f306d8-f3f0-4a85-a1c0-fab045ef594d", "comment": "Malware payload (RaccoonStealer)", "value": "3a3ab90429325f26be4c1536825b7d86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753589, "uuid": "c0d80673-64c4-4303-866e-31454ce299e9", "comment": "Malware payload (RaccoonStealer)", "value": "9dab2a8cd79a947c700da1f58f7e967fd81cc321414d4cb512ab65b483834798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753589, "uuid": "fefd6539-38d0-40f7-b02b-f51eb2176d30", "comment": "Malware payload (RaccoonStealer)", "value": "33c272468c115890d6a44cd6918509d37c89ce04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753589, "uuid": "63309462-5e8f-4ff7-a333-60736254d986", "comment": "Malware payload (RaccoonStealer)", "value": "823b1cf7f2e37e883e9ab91ad1a25bd08624ed34156a48ea0fd2ff34e5f8a46e72f27dd9398519b37f743e71e0b76b54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753589, "uuid": "66237984-974b-4fbd-95b6-a06db7f6057f", "value": "T10AC4D030BB80C435E4F642F885BAA3BCA52D7A71973450DF92E42AFE57346E5AC30257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753589, "uuid": "8d77461d-8c19-462c-bbc4-f99288b33e7b", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753589, "uuid": "6e1564ff-088a-41b6-b74d-d8dc59a8cf3c", "value": "12288:PwdMXQKgBN/6gADczag9yu7EXZLpryKGoXHUtkxF8y:I2AKgPFacFQZeoXH5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628753589, "uuid": "d9cba628-51af-4950-957e-838ab3a7f0e2", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628753589, "uuid": "be7e5cd5-556a-4351-8ae0-69c807d6c66c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753589, "uuid": "7edbf04d-fcbd-4236-b769-9bb4e6f08a41", "value": "3a3ab90429325f26be4c1536825b7d86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df4866c-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767714, "uuid": "fe255238-a47b-4bda-9b87-e6d0f4eecf5a", "comment": "Malware payload (Nitro)", "value": "e736f970d2f2a41818ea91cc1b79db97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767714, "uuid": "7b75dbde-5647-404a-a430-e53320f9a994", "comment": "Malware payload (Nitro)", "value": "9dc829191b3e2b6a07d3bc55ae8faa38b12cbdb6060ee20be236319489578e42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767714, "uuid": "59911a13-1430-4727-96ef-7da65a1242c0", "comment": "Malware payload (Nitro)", "value": "3dedb0667c1b3ed98df78c5bd7a4e86d3e80a7e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767714, "uuid": "b97f8355-cd86-4559-8e1b-2654ac04def9", "comment": "Malware payload (Nitro)", "value": "1027dc265f4d5d257807d074b8f382433300773a8d933d789c41547aae151d6af7aabafbec6e4db95bd32f43e1c87724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767714, "uuid": "ece89292-5101-4aec-b95c-679649f94ce0", "value": "T1065364286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767714, "uuid": "28b733a1-4b8d-4604-ba98-25c1372d5040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767714, "uuid": "083a1588-7bff-42b8-8a5f-4c188058168a", "value": "768:2OucKn7n1JAPfRANIUDaBvLDwUzc80gmq3oP/oDR:2O2afRAPmpr/0O8/ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767714, "uuid": "bc0af658-6e45-457e-bf63-e6626bc44668", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767714, "uuid": "57fcdd1f-49f5-4483-a1a4-a93c21cdae4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767714, "uuid": "ba9bb383-29fe-4ce0-bacc-794c1577eaad", "value": "e736f970d2f2a41818ea91cc1b79db97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6b210b-fb5a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628765136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765136, "uuid": "7571e875-3c48-4a50-8204-ff405032cd1d", "comment": "Malware payload (RedLineStealer)", "value": "e913219e5f91222d184ecc758088ef02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765136, "uuid": "d7f44e6f-b046-4ac9-97ee-b44bd4715e3e", "comment": "Malware payload (RedLineStealer)", "value": "9dc934f7f22e493a1c1d97107edc85ccce4e1be155b2cc038be8d9a57b2e430f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765136, "uuid": "d9812250-b107-487c-bff7-1531c4621801", "comment": "Malware payload (RedLineStealer)", "value": "e3e9a88a115f3661d55655a096b013f192b93a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765136, "uuid": "7801853e-55d9-4c01-b473-e425a8a88b08", "comment": "Malware payload (RedLineStealer)", "value": "e310f7d53959c3d0020b6564562a531a7324607c94341bfeb92131b401c5738c55e576f52b7577d771324d45d34d6c6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765136, "uuid": "521b0942-dfe9-419d-ba36-5491568f50cf", "value": "T115A4E0D5B528600BC8A804F4C48B26F03BB06E756856EFD5ADD0F6DF14FAF84B642897", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765136, "uuid": "b4b6fcf0-0e90-49d0-831e-bce4d014ae7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765136, "uuid": "86401dcb-c863-443b-a47e-716e36fe3d2d", "value": "12288:OdQGx+KnXxFfjAQaKXGBmpO7AJ7Lgm9j7:OdvPjfav0pNJLgm9j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628765136, "uuid": "828cdc39-4b32-44e6-87e2-7845fc311d5a", "value": 459400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628765136, "uuid": "2912e55a-5870-44b7-bd7e-07ac1086eeb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765136, "uuid": "2781039b-8ab5-452e-9639-8d8ca150368c", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab98c07c-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767388, "uuid": "ed28d5df-a827-472d-bdff-9e05da91012c", "comment": "Malware payload (Nitro)", "value": "64098b0feaebbe2746fe5e1b0a395e77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767388, "uuid": "1ae8c16c-5093-478f-a7d2-b7a95464b995", "comment": "Malware payload (Nitro)", "value": "9e74dd5256ef30c2f3a8bef17e8af61869ddb9dc911754d619575a3e539c99f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767388, "uuid": "6a25d7a3-0921-4fe5-99f3-c16d75af9fd8", "comment": "Malware payload (Nitro)", "value": "dd12d8776f8a2659490e85378562d23b093f14fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767388, "uuid": "180b7444-9de6-415f-8930-6f7ffa01cdb4", "comment": "Malware payload (Nitro)", "value": "3a4c205d5b52b65a13ba07e86df4e13ea7363c67bf36b783150ccb5b3f7b420fcf06558587222f3cb1c7660bc54a6304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767388, "uuid": "ceb3d046-ee49-46ff-8615-e90713238e30", "value": "T1E353542852738A2DC47C82B815FB2F7C27B0AF565460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767388, "uuid": "6d37419e-94de-46a8-920b-1f402b3b8c8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767388, "uuid": "7afedf7b-2ae9-4740-ba4a-7e00450a55ed", "value": "768:JKsMqCXfVcWp3M9ZkiANIUZd9YLDwUzc80gmq3oP/oDs:JKse1M9ZkiAPZEr/0O8/og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767388, "uuid": "1d8b87dc-314c-4c2c-8fb9-008b19743bbe", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767388, "uuid": "92ec7fde-cf4b-4aab-91e7-d0cf9297f7b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767388, "uuid": "5e23e32f-7f08-4783-9eb5-f9fdd35f626e", "value": "64098b0feaebbe2746fe5e1b0a395e77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d0a357-fb75-11eb-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1628776631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776631, "uuid": "531035f8-74ad-44d6-9d59-3c9752f70270", "comment": "Malware payload (KPOTStealer)", "value": "c0d1e600bffd7379946874f0718b01cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776631, "uuid": "20e9770c-de24-4824-b57a-7ffbee2b14e2", "comment": "Malware payload (KPOTStealer)", "value": "9f1c935d143a59d2429f2681007c61ee07504302e5798d7abdb9a5d44d90e13b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776631, "uuid": "58d04cce-cf05-4df0-bc48-bdb18a1cf329", "comment": "Malware payload (KPOTStealer)", "value": "85353af282c3d6f57a9299fc76ca26355add2d45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776631, "uuid": "bd6876f1-be80-45c9-b296-39a0e163b58b", "comment": "Malware payload (KPOTStealer)", "value": "79222d0c6cfe7a0049f498ddb9ad89c09b4efc403ec42102b76a1bad04ff4dfd825725a8c58490b084595e48426d192b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776631, "uuid": "c3039811-cdc8-4b57-801e-f9d1508e7068", "value": "T1D3A4D030BB90C035E5B702F845BA537CAA2D7EA0577490CF52E52AEE16386E4ED31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776631, "uuid": "c6ce20f5-f382-4264-a248-95fb46167ec0", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776631, "uuid": "1ffcd68b-e100-4d49-8113-87013c7a088c", "value": "12288:+bXYKVwQHh5T/0tb2A6yZdsPZVa/CYjcXLmPdKSoK:eI0wa3xyUfajcXZXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776631, "uuid": "9a179fa0-a96b-4be0-8e2c-d17f3a59ecc1", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776631, "uuid": "a588ff1b-288a-4239-bc17-cfb66231df71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776631, "uuid": "bfe45a0d-bdb0-49f5-9b09-110b275cd42e", "value": "c0d1e600bffd7379946874f0718b01cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073ac16b-fb18-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628736618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628736618, "uuid": "6df1ea5e-01be-4208-9d79-cb132d103934", "comment": "Malware payload (RedLineStealer)", "value": "6265ce87d54f68b1031341d5f335e970", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628736618, "uuid": "351017ae-e6bd-40af-a1ed-68b0976bf947", "comment": "Malware payload (RedLineStealer)", "value": "9f322df416d8c350f577677c1654efde29b5bbfc09e2510403953d1af7e37875", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628736618, "uuid": "583e1eb1-d54f-4ced-b572-64b07dac015c", "comment": "Malware payload (RedLineStealer)", "value": "dd333960f92e5feaa96071641cf485d210dbf7ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628736618, "uuid": "0e7b761c-38bc-4d65-b963-077f9db20b22", "comment": "Malware payload (RedLineStealer)", "value": "8e908a637844a263c0175391de5733d0aea128419034e22b25e6ee2da5c9b09592e8864310a7a788cadf3f4e0ab24ec8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628736618, "uuid": "5b2fd7bf-df32-47b0-a2f4-3f0bbde46f87", "value": "T1FEF4122236D1E031E96315309DF4A767EA7CB9316E76658BB7900B1E3F716A2C227703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628736618, "uuid": "25654e4a-66b5-42fe-839b-1e08309fbad0", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628736618, "uuid": "c6765146-5d6a-407c-af5e-4aac36568595", "value": "12288:pY20AljdZgBPfKf34MQxAogJfqsUsz0cX0s5liCQie/cR0NzvnZ3/YW+5:e20gPgFKQMQxAVBbIcXpwC/ekRuZ3QR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628736618, "uuid": "e419258f-2c32-4f60-ba87-5d664c5ed406", "value": 739451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628736618, "uuid": "66599c56-c2ba-4f21-a851-7603a4417b94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628736618, "uuid": "2e60d912-97f1-4a76-bde6-30a33219b0ce", "value": "6265ce87d54f68b1031341d5f335e970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40511204-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750458, "uuid": "2182c86b-ca9b-4d33-84f3-6eb91ba7b4e2", "comment": "Malware payload", "value": "5cde664f12547b26f2f59237c49b9acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750458, "uuid": "b9492eb1-dd46-4b55-b190-7645fc88993d", "comment": "Malware payload", "value": "9f3805a821c12122b67395c50e390d35c70e83d5b82a6e5741e56c0087960a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750458, "uuid": "d441221b-ea70-4430-aaad-530559f6ec64", "comment": "Malware payload", "value": "e2d0b17f457292bc694972e94bc4ba057bbe8f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750458, "uuid": "713f77cd-597e-4193-95b2-6e6f5909273e", "comment": "Malware payload", "value": "f606315372b98090ac8cc235d2a26548f1a007bf4888948e65781d56f3db6a764699ee6e89ed4ebefad27ec568b9e7db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750458, "uuid": "38b7f7cd-e5f3-4ed4-ade0-200aea7b6c98", "value": "T128B4D030BB90C034E4B712F845BA93BCA93D7EB1973450CF92D52AE956346E4AC3179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750458, "uuid": "9b165047-b8f3-4392-9642-1f0731ee5767", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750458, "uuid": "8b903c58-0e6c-4249-b684-bd8f0fc3956c", "value": "12288:zSttX3l7WdYcDh2ZSvE3By5IciAiENqeKmukJnym:Gbnl7WdvTi1iAmRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750458, "uuid": "a4f28ecd-7211-4375-aa3b-1ce50a50e20d", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750458, "uuid": "740ee403-fbe3-4f01-bfd6-d80731edb2c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750458, "uuid": "3f18c4e9-4298-4c11-aa68-f179f89f1841", "value": "5cde664f12547b26f2f59237c49b9acf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1ab477-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738644, "uuid": "ca43afe4-7367-4751-95d6-dec56b144cb4", "comment": "Malware payload (Mirai)", "value": "7dc3f01dfb75b94bda71e655a60400c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738644, "uuid": "8291c794-7ee8-4a0d-9bef-1c9961d498c9", "comment": "Malware payload (Mirai)", "value": "a00c471c2fd1ebdfa810d7e01928640e84634dc9d3c8d8a65be5fe2f13628552", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738644, "uuid": "e4cbe39f-ec4f-473f-a7e3-a02e1ba068ca", "comment": "Malware payload (Mirai)", "value": "1424bf7be2a2f3aa33d9fbe20835ba542120d026", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738644, "uuid": "3eccc4e6-ede8-49e5-820c-40b80322c487", "comment": "Malware payload (Mirai)", "value": "725eb50c2285033809e41888888757bebd2753111c9c071c490826bc0746f030fd2223df2919c8edcc769d389f8fe3e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738644, "uuid": "fd564ec0-27be-41e6-a663-ce2188b7c890", "value": "T14CD33B05D8909767C6D227BAF79E428D73236B68A7D733115A28AFB02FC1B9D1D3D060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738644, "uuid": "e9a0f538-3706-4a31-a015-29dc85064d2b", "value": "3072:IVfyQ+d+pceQGftb3za5fJhWOiwTteOHo45hLMO3K4G5ZZPMmydQCYMhEFg:ub3za5fJhoIHj5hLMO3GvkmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738644, "uuid": "fc151618-53a4-4807-86f0-0a15af44be5a", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738644, "uuid": "34ea15d3-5dce-4ba6-bf58-0dc3b1cc8a88", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738644, "uuid": "7931d357-3727-40b7-b095-a8f3da7b4c08", "value": "7dc3f01dfb75b94bda71e655a60400c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69978e44-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767277, "uuid": "9aadcd10-3f93-4012-ab32-8e8aa16aa79a", "comment": "Malware payload (Nitro)", "value": "1484a0ecf720d351f8897c2f9b3f5046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767277, "uuid": "02bb028d-799d-417d-b8a2-81892eca568b", "comment": "Malware payload (Nitro)", "value": "a00d950fbee25d407f79f5d7211cbd1f15d27f89bf5714e44f222c9013f6c131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767277, "uuid": "92289dee-17a9-4805-8d37-d68bb45762dd", "comment": "Malware payload (Nitro)", "value": "8770a72054cc21f07051df2b4c0f7775cc4fa731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767277, "uuid": "ecf9d042-57ec-4cf0-ab4a-1b30bf95b07a", "comment": "Malware payload (Nitro)", "value": "8664cf466df73dead7a1a906b03db8e78d5e90cb5aae8eb8b3d823172ddf3476fe0794c795d9aa29116d720894b83d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767277, "uuid": "1c723730-b14e-457a-b93a-b9b565dce3f7", "value": "T15753542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767277, "uuid": "f013c584-f4c1-4aaf-b092-567292118340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767277, "uuid": "395515bc-57c4-4deb-a23a-0c0fb14f4f94", "value": "768:iKsMqCXfVcWO/M9ZkiANIUhyIYLDwUzc80gmq3oP/oDn:iKseiM9ZkiAPhAr/0O8/o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767277, "uuid": "70bb1244-cc9c-40c8-bfba-1b228cfe6b07", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767277, "uuid": "8d9bc2c5-9ece-4893-8f68-834c594268d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767277, "uuid": "705f338b-9283-40c1-a347-9aace7276e26", "value": "1484a0ecf720d351f8897c2f9b3f5046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e13483-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767752, "uuid": "6a27b354-6153-4aa6-8ae0-b86ec928c3fb", "comment": "Malware payload (Nitro)", "value": "fe06de32fb4c4669f1a2f89bbe07ebbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767752, "uuid": "d2d46d01-9bd5-4f3b-b510-308d09589803", "comment": "Malware payload (Nitro)", "value": "a06bbb0e419c7a96625a26261b8d3d2307bcb27c724cb339f4e903bb9965d61b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767752, "uuid": "72859b06-8c6b-46ae-b218-d12107ce6eac", "comment": "Malware payload (Nitro)", "value": "7649c0dcc88063fb5ac2bcbac7ff667da71d3b79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767752, "uuid": "0a6da549-1012-44eb-81ec-e4998f37c7d3", "comment": "Malware payload (Nitro)", "value": "5af9b343c43e9503791b5f1361bf22b7f2a71deaba56b2f488899e078c984811b53e7820fdfb27b8c47d4535ebbdc4ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767752, "uuid": "163886c3-7b5a-4440-9db0-1fc321b6b0eb", "value": "T11A5364286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767752, "uuid": "8f130679-293e-4534-9dcb-e590a2a3ad03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767752, "uuid": "847c63f1-25b1-4a6e-a82f-b00dfdec044a", "value": "768:3OucKn7n1JGDNANIUoLvLDwUzc80gmq3oP/oDN:3O2GDNAPkr/0O8/oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767752, "uuid": "dbbd8118-66b4-4bac-adf2-4a2a37b7de7a", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767752, "uuid": "9847b717-c3e1-4f9b-8e4e-8000948bb3b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767752, "uuid": "f18fb2dc-26b4-40ba-9848-877bfc31158e", "value": "fe06de32fb4c4669f1a2f89bbe07ebbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235a5461-fb51-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628761146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628761146, "uuid": "3af0f557-f598-4fd6-9087-dbbeef9970e0", "comment": "Malware payload (AgentTesla)", "value": "183a74881d9186877560b002095a253f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628761146, "uuid": "e0b8cf21-82d0-4321-80ab-73550228a690", "comment": "Malware payload (AgentTesla)", "value": "a146e768cf4a675a23e8cf6d69ea0cdfc57cca8ae35be0987e6b4e1c8ccbffaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628761146, "uuid": "7905d7de-38ca-42bd-ab08-88856e1c2507", "comment": "Malware payload (AgentTesla)", "value": "94adea637d18f49f73236c0a2ecc530cde4fd2d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628761146, "uuid": "7d6b69f8-8f6a-4c5b-bd33-903c7b49cef6", "comment": "Malware payload (AgentTesla)", "value": "c55d3b952b6822d6d211e480a23b88da390740c1006bded56a4048b6d715ff0ec27d2bf83b893e94403a4d00b00b0742", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628761146, "uuid": "c7320daf-df88-4806-983b-b3fac78c1c11", "value": "T17915330AA3A7EB43809B51798D45849891096FCF9801135839C8F39F7CBB93FE7D6897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628761146, "uuid": "773a73df-2211-4f72-958a-d482fe813833", "value": "24576:GOMzeX1LUT7asptPluvCbYrNtaej4M/VnVPjc:GOM2LUT7RHuvCbYPzjJ1jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628761146, "uuid": "eb412409-d41e-457a-a925-c33d6bae2e04", "value": 886308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628761146, "uuid": "bd5cf562-b56f-4287-a389-2467a3cab285", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628761146, "uuid": "8743b3b0-773a-4280-a0f5-a774dc360814", "value": "RFQ00821.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80519c8b-fb36-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628749706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749706, "uuid": "1f748f88-69ae-43a1-87c3-a9f958e39054", "comment": "Malware payload", "value": "9586ba5c939a8922c84a225ee8348192", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749706, "uuid": "34804b62-8ea1-4b4c-b992-359a018123bc", "comment": "Malware payload", "value": "a29136e7f12acb34281f392d204b5c90828397cdebe013a5a6821fa01ced3f98", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749706, "uuid": "8092dc51-67a4-4f0d-b425-3cad792ad2f8", "comment": "Malware payload", "value": "44cca0e100958696e33ff8956946741a1cf9d5bd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749706, "uuid": "3727f767-921b-4395-816b-234e2a71730c", "comment": "Malware payload", "value": "4850f30cb99e7c43c74bc625c19ecc43eeaaa7034aa760d7119a6fcab981916d7d534bdc764dd60b4592a61b63147a42", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749706, "uuid": "659e8e50-a0cb-4816-ac37-4baff4e14cd9", "value": "T155A6339FE8061F09D315C89F5ACB89647C9F41BFAE929F27302A74235FC5986B43106B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749706, "uuid": "ee8ea8ba-0a37-44eb-b9a7-d1d841bdba6a", "value": "196608:V5kfGmr2YDGikPzAbDj22arKbFmCBwqkk8u3Ehz:V5kf5NzXjjGo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749706, "uuid": "24867f83-7927-4ff1-af53-4e128498fe22", "value": 9681772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749706, "uuid": "3fa01cd8-fc4b-400e-b9ac-ecb839d48c16", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749706, "uuid": "f620f55d-417c-4923-b22f-eb52cb702e27", "value": "MPR.dll.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a2e453-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628776392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776392, "uuid": "28835f75-0f6e-4bd7-9433-f88837afe93a", "comment": "Malware payload (Cerberus)", "value": "91964426f769c467e1d5a58875cb4ba9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776392, "uuid": "e813b312-ef9b-45d1-af5c-76b03fb006e1", "comment": "Malware payload (Cerberus)", "value": "a2f87e81afb6b58993df52a68c73f13121c093e11c5be97d4c404080bf5a4def", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776392, "uuid": "5ff98a88-2981-4e9c-a342-0bb6c31fe7f6", "comment": "Malware payload (Cerberus)", "value": "6a22b54c090847c0ba5713cf0b1d6e4b79f8d77d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776392, "uuid": "5633d78b-fc95-4e79-97dc-b4e3e09b9167", "comment": "Malware payload (Cerberus)", "value": "84db34160ec9daf7bc16983bc68062e692ffc6ea56d54b6c72eff759573f6270ddd0d01098d2bf4889e0043776f72cd6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776392, "uuid": "741a6d28-0e34-4218-bfa7-d80307b8f0b9", "value": "T11EC3F14A63B0B062D19B58B4A2A8F3716F7BD69854F23353A7253356CC8FEB42F18D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776392, "uuid": "cb044684-90f9-488d-a19c-08b31eb2c6c6", "value": "3072:Vjn16Q9qqLN4g0cH6n9xxAhsghsH010D0s:x1h9qs4txn9xxArq010D0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776392, "uuid": "c8aff35a-cfca-4f27-80ac-51a770dff77f", "value": 122052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776392, "uuid": "cd97023f-f43b-4bd7-b40e-1e826020b268", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776392, "uuid": "530a11ce-e8f2-4364-bf03-c794a62eb09c", "value": "Android_Guncelleme_build.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09806b9-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767504, "uuid": "4c09b610-f9c5-4a62-b8ae-260a040e8192", "comment": "Malware payload (Nitro)", "value": "aa1c9b407f9399f88b60cbd77bd271a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767504, "uuid": "30aa1be8-652f-4a40-9ee6-20826202caca", "comment": "Malware payload (Nitro)", "value": "a31518f6725008ecbd48a1a5f2f77eb7fdd37d5f8d47678002b6aee6278a8661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767504, "uuid": "a76a6145-f400-415f-a887-6be4a43014e6", "comment": "Malware payload (Nitro)", "value": "f430b1f4cbb55446be25d3a55bf68e047d209a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767504, "uuid": "0d9350db-5d74-439e-bfe3-eeea3eb88900", "comment": "Malware payload (Nitro)", "value": "4636819c90115f9196a8b804feec65efb51e78bce871b1b91a87e05f084def115428ea92e44f2e104100f6f8b78c5ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767504, "uuid": "6155c4f6-a5f6-4927-b7e6-9e4481b7d636", "value": "T14F53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767504, "uuid": "f4673604-1faf-4a37-9ad5-dd2c3e939459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767504, "uuid": "ee4b2bf4-81c3-43b0-ac1e-cf45b1185f0d", "value": "768:gKsMqCXfVcWO/M9ZkiANIUETCYLDwUzc80gmq3oP/oDc:gKseiM9ZkiAPIr/0O8/oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767504, "uuid": "d31699dc-ed96-4aa4-b5ac-7e40fbc7d124", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767504, "uuid": "0ea9bdd0-c928-431c-9e6d-3b4477e58cad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767504, "uuid": "986109cf-7ec6-4597-973b-d09374729bf4", "value": "aa1c9b407f9399f88b60cbd77bd271a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c37b36-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767004, "uuid": "18f54bf4-97b3-4035-a5a7-93a902c59930", "comment": "Malware payload (Nitro)", "value": "8f7cbd3b6294a51d05d845817a537c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767004, "uuid": "194ea675-1259-4bda-96c7-eff595ac30cb", "comment": "Malware payload (Nitro)", "value": "a38318931bf23ba293888c2685d85b3cb376d86ca16d3348f7f5ed57165ac1a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767004, "uuid": "e24ef1e6-fbc2-4b09-9166-1047098b035d", "comment": "Malware payload (Nitro)", "value": "f8111013086ed399ca719f7ae1971b647791832e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767004, "uuid": "4acd14c3-8d86-4cb8-bb3e-3f63a01fc64c", "comment": "Malware payload (Nitro)", "value": "a836a7d5a22692e0eb1727a889545c25e86efb1b536d936dbf63adba07de6e6bc4131e8f8dd261b919eb062d3a52eaf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767004, "uuid": "df3db642-9972-4eb7-86dd-2e60eb707bcc", "value": "T111B523C033CB0226E2AD8C393D7513501368CFB65893C2C969DA579C9B71F84AD98EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767004, "uuid": "b68032e3-11f6-4aef-b331-8efd6d118280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767004, "uuid": "9bec1056-ff94-4995-88ca-07a3fe89a8ae", "value": "49152:dcAVHF/hLAkvUG0M7tRUlCnlSNPMzEvmhzQ9QJmqpcg5INw/8hPBTLF39:dNhLAybDRXY0zQS7crNdhPL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767004, "uuid": "74a7d67a-f562-4844-96d8-c9c0c3aa8c4d", "value": 2338304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767004, "uuid": "1403a7dd-1145-4738-8ba4-c4dd2a6a0d7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767004, "uuid": "75c9b5ee-0834-41c9-9823-40050a636bab", "value": "8f7cbd3b6294a51d05d845817a537c12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30abbc2a-fb71-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628774913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774913, "uuid": "d8da9a5b-bbf6-4f3a-a15d-98e94bef5771", "comment": "Malware payload (AgentTesla)", "value": "4b8dfb73e8a6ef44c5ee1daf91956448", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774913, "uuid": "84300244-c818-4fc9-a5f6-f3d17b34637c", "comment": "Malware payload (AgentTesla)", "value": "a5512bb93b3d36122fe75d5f4cac2904947942704674ab517f4aeeb2eb0a988f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774913, "uuid": "78be9e88-b13d-4c11-ac67-b4cfa9db7cc4", "comment": "Malware payload (AgentTesla)", "value": "d7e7f2ac4d1b472649b9f49a29ad9b8b16c1bf5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628774913, "uuid": "e6a78b34-dd5d-4a6d-a6bf-6631be82062a", "comment": "Malware payload (AgentTesla)", "value": "7df9b7270936130c4ade01ea93deeffd40c62b59e2984d4729306e903238a47f47e659b317db55ce4124ae32a3e86b9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774913, "uuid": "abe64f4c-3a07-4508-a94e-d747819ce9af", "value": "T17B55F19A375075BEC917CA7289141C10EA61AC6643CB863F90133D99DEFE9ABCF051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774913, "uuid": "34b137ae-6e47-4024-a0fb-e4b0d8a2750e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774913, "uuid": "f332b2c5-915e-48b8-9b94-f6338da2580f", "value": "12288:Zfoa6SHABUTQgjfNGGypLNRTdN3+bawXlknS79N1PB0ozDbj1dtaEwN4Q6H+Uy19:Jz6GA+pNGGyb9dJ49kS7d75hWZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628774913, "uuid": "a0b7148a-fc70-4949-8dd4-16c3b00b3a58", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628774913, "uuid": "c0766ef9-dd5a-414d-bcac-8fcd92dfb462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628774913, "uuid": "54ef8c0e-a9aa-41cd-aba2-4a3af91e43f0", "value": "NEW INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a56c6cf-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767708, "uuid": "c4c58483-3903-4235-8f35-7c40717a07fa", "comment": "Malware payload (Nitro)", "value": "e279b94a16a7339b67f596d36972b53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767708, "uuid": "cc77c5d4-89eb-4864-a976-80b27978c4cc", "comment": "Malware payload (Nitro)", "value": "a55de74765216e4695ca88b94be1d030646d746ca16957768a94d49aa244c905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767708, "uuid": "6dec386b-9374-4788-bf53-c700b39e8107", "comment": "Malware payload (Nitro)", "value": "0cb7466452229dbe4cc4c7eaee0015caaaaf58c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767708, "uuid": "bd9d5f43-e8e3-4f10-bcd7-71fcf30b69df", "comment": "Malware payload (Nitro)", "value": "55122248cef7ab7910b5f3385ec82139e8ff6b2be629e1d138f1233ab19af57fe2b3878e7169d66228f4062ca3bd1ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767708, "uuid": "d45d4f44-4e84-4038-8b7c-4b5a4e11ff8c", "value": "T14753642852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767708, "uuid": "e5f6dbd1-2043-420b-be20-3c6357e19f95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767708, "uuid": "837555da-5665-4228-8392-6fbbb0fb68e3", "value": "768:KKsMqCXfVcWpjDMLoiANIU0YdYLDwUzc80gmq3oP/oDJ:KKseVMLoiAP8r/0O8/od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767708, "uuid": "2861236b-d076-4270-8869-8d55dc99c1d4", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767708, "uuid": "6a96cdb1-4a4c-4179-b5ec-00be9179392c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767708, "uuid": "93aa3a04-5ee2-4a62-814b-deba922f2b28", "value": "e279b94a16a7339b67f596d36972b53e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08e58a9-fb80-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628781623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781623, "uuid": "c9dbed0f-5453-4887-babb-8807868c7389", "comment": "Malware payload (RemcosRAT)", "value": "72272f92ab113c161fb94932d478dd1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781623, "uuid": "7f2ebc1e-373b-4f71-9175-60841625049c", "comment": "Malware payload (RemcosRAT)", "value": "a57defebe6f605e5c8ec0233fc81166f9a53abfc2465be6a738072d3e44fa414", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781623, "uuid": "2df65864-a7b9-42c6-9a21-8cdfced8e6e8", "comment": "Malware payload (RemcosRAT)", "value": "6b2cb56eef2d747e5f68a688e0cb1f5d6a8d587a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781623, "uuid": "437d409e-ee84-4b4b-ac7d-b94a4a26b186", "comment": "Malware payload (RemcosRAT)", "value": "7b417084e180893728d605dfe3828f51b3ad2019fc25a5f131062abad7d4b9a2f71557fed48650a49d48e3d4012baf38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781623, "uuid": "8be53e2c-625b-4027-85e4-03caa8371149", "value": "T13E859F3D19B92637C1A5C6758AE18817F0409CAF31D1A9BC94D27F66C3F2A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781623, "uuid": "62d71e72-175f-4f88-80b2-133f9ae3f0b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781623, "uuid": "64f8dce2-efca-4ede-8a29-5ab44d46c2c0", "value": "24576:aVHXdjBCInPMSS1ttRYLSDab65NCANZZS5R0:aVHXdkIn+PnUKCAN3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628781623, "uuid": "b40f07b1-6e5c-4756-b577-aa7bf0002af3", "value": 1797632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628781623, "uuid": "37ee274f-672a-4ff0-80d8-88947304b1da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781623, "uuid": "7b07fa8e-8dd5-4c96-83e3-110bb99f734c", "value": "72272f92ab113c161fb94932d478dd1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1f084b-fb61-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628768192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628768192, "uuid": "24d723ac-7f3d-438e-b098-a4cc790e2c7a", "comment": "Malware payload (Loki)", "value": "f0cb70544eb71fd9054d9d475ab44633", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628768192, "uuid": "d833c3ad-fe18-453e-b7f7-5915226c1c79", "comment": "Malware payload (Loki)", "value": "a62490b7606b8b4da18bf697605bcd7f7297cad0b220900e364e1755c0852cd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628768192, "uuid": "3ca6ad5d-68db-4a95-855b-b45cb0ff62ed", "comment": "Malware payload (Loki)", "value": "810edb5a89026c9f3d6090dcb07e64e8cafdee50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628768192, "uuid": "b36fc548-3e36-42d9-aeaa-763b1f196be7", "comment": "Malware payload (Loki)", "value": "2b3a8e534bd5465e3be6c624a9d1af496232ad602f492d043facb622e5985cd5828e8d2f403dc98865361ff9458e4c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628768192, "uuid": "a735bba5-bd2a-45f4-91ef-ed129cbcf1d7", "value": "T12034F1F7079B6A11C002C17897049B6F2E820F35A87F02BB878C65865F255DBBD9CB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628768192, "uuid": "b944fa54-40ae-4e7b-8753-61cfdedf1675", "value": "dc195339b27b4fd5a57110edcd4091c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628768192, "uuid": "80e41a1f-7633-4216-929e-edb0af40049e", "value": "6144:yc1FwB8FXgtD+xC4SwCMSk3fCDPOsoWP04d:y5B8F4NN8S2yO2s4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628768192, "uuid": "42d9fb54-2a1b-46eb-82ad-7e365dd7872b", "value": 232780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628768192, "uuid": "bd6590c6-f9b6-46cf-9d52-b128c79cb94e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628768192, "uuid": "20226aa3-8d3f-474f-b80e-8016ec79f958", "value": "po-11143021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cb7253-fb27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628743407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743407, "uuid": "fa61a068-1c1b-42c1-8a48-612828a8f128", "comment": "Malware payload (Gafgyt)", "value": "497bafd70c3190a0e7ef5209e0d8ff5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743407, "uuid": "573ab0d3-b7da-41f9-8d42-3466704039ab", "comment": "Malware payload (Gafgyt)", "value": "a632c671b3fa430f9e911e5e9c61ad7d190092817a9a1c132326de571fe5815a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743407, "uuid": "8ec134eb-0c5d-43ad-9030-7fbac01cf4b1", "comment": "Malware payload (Gafgyt)", "value": "8dee1186ac7c9f47704bb810b9434797580b2520", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743407, "uuid": "6f9f28d9-51d4-4405-a5ba-063dd2712386", "comment": "Malware payload (Gafgyt)", "value": "0108e7834de6c20835dcab5385ec25fc656464296f490890749165abf99b30b0c2c706e9094d996eb7f7dadb40ef7d34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743407, "uuid": "f75e3ab7-555a-481c-a5e9-76cc186ba4ce", "value": "T16D431C45FD418B17C1C327BAB7DF476D7B3669149BDB330166287EB427827DC2A2A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743407, "uuid": "9ece4dab-8cc8-4c99-955b-4c121e57efbf", "value": "768:2oyaO+9APimgnfSzgLMj+M/oTEP3iUmm1Fl6MI1LqPIgpu90pQwQI7Omb:YxUAPiZk/Gei3m1hiLXgpZD15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743407, "uuid": "17dbd05a-be0e-4cae-930a-946e90265371", "value": 60014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743407, "uuid": "ba9d4598-7a08-45c6-9783-6fe8ba262461", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743407, "uuid": "36a1aa95-ed10-41da-a094-78d0118c19b3", "value": "497bafd70c3190a0e7ef5209e0d8ff5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9af994b-fb96-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1628791007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628791007, "uuid": "6ebde7fd-71ce-4dd3-98af-ee2571156680", "comment": "Malware payload (Glupteba)", "value": "d9e7c7875dd2b094bc057ec4197b6a0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628791007, "uuid": "f7213a85-9e58-45fd-8eb9-8fc17952ff27", "comment": "Malware payload (Glupteba)", "value": "a7a2d5e0d31d31e452252c14023420621e92967814dc6410f783c5f101c3de1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628791007, "uuid": "8602e202-9773-48c9-ab12-28b7ff2bc38e", "comment": "Malware payload (Glupteba)", "value": "eb5db161873cc4760e17ea104bcf06721adce035", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628791007, "uuid": "2ec497f9-6716-4fe6-b679-f01ea0f1e5e0", "comment": "Malware payload (Glupteba)", "value": "c4961df1f309f90163a927f7d71f5b6934328b7a536902b640af07a2138ed3f35422f018656284a391110d31801dec2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628791007, "uuid": "56728cd4-96fc-4d4d-8521-f0de1f387716", "value": "T1D22633216B51C030F1B512F446E5932DAB2CBFA09F7559CB92D92DDB8638AF0BC7170A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628791007, "uuid": "56a41200-1547-47bc-8dcc-57a3b2fbd07e", "value": "ded4b5426e5df06be77a7a4dcec66fd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628791007, "uuid": "03f76dca-1ec7-4ec1-a71c-e8681df88150", "value": "98304:YJfS2jP3BoMvnGdSOaiW4qOeW20lCsfwbbjTtskzz7kLobA9Y/oBEJTHBJoBkA:YfU2aeWlqnftVf74sQYAUFJoBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628791007, "uuid": "fbc73d13-cfe6-46d4-b720-396ceff9728c", "value": 4715560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628791007, "uuid": "0dfd7daa-dc3b-4f8b-a89b-ea17f03718dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628791007, "uuid": "f2cfab31-3611-4cd2-91c1-070c33b037cd", "value": "d9e7c7875dd2b094bc057ec4197b6a0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429f1e36-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628776231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776231, "uuid": "1295be45-24ec-46b3-b596-f9eb9c3eee67", "comment": "Malware payload (RedLineStealer)", "value": "43dba0e8a383863fc63b8a70d87bfba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776231, "uuid": "39d36185-d3be-478e-8501-692ab3899c2e", "comment": "Malware payload (RedLineStealer)", "value": "a8c01f337163dc0e0bccb3a85bd0bdca149a199e2d879771e05037ed00c8e967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776231, "uuid": "714650c2-73f1-4908-90f7-26ef887c5e53", "comment": "Malware payload (RedLineStealer)", "value": "02d43ae8b5fa933f34ff3e0686a93fa207d41056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776231, "uuid": "473a5c99-d04f-485c-9666-c33180d50caf", "comment": "Malware payload (RedLineStealer)", "value": "ab72e57105b16c1cd2862f5070faee75b3d9bf8074c311b4408e8e5e394a84ceb67b76e6974aa5d79aab7836cd1da26a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776231, "uuid": "009bc975-7759-49f2-9602-133f48615a99", "value": "T16E05C0423284DD9AE4573AF2089FD46012F9BD8F8621C60E3F877E2B59E7702246775E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776231, "uuid": "ab43e328-78de-4de3-8884-995fd7e3f149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776231, "uuid": "8dc0b441-7c53-4a9c-aa00-a13f52c1d43f", "value": "12288:WiG/HK7zc2w67doBnvGuCVg+4JVkjzCcDRCQx2gLFEU6LyD9SiyyjK:34b656euChyV+CcRj0EFERGd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776231, "uuid": "cb2acb83-206a-42a4-b851-6f8190ab6cf2", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776231, "uuid": "2c72a1dd-2bde-45db-85d4-2101f7959fab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776231, "uuid": "287c1563-ca08-44a5-a149-e86825477941", "value": "DOCU_SIGN992020299393948883.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b67122c-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750503, "uuid": "5bddaa62-663c-42d5-8a4a-f00e94ac8988", "comment": "Malware payload", "value": "09614e70ccc217403b852420ff7c9a94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750503, "uuid": "26afbd19-2182-4d3f-944f-bb6750f15caa", "comment": "Malware payload", "value": "a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750503, "uuid": "3043fda5-ee34-4b6e-bfcc-fffce834decd", "comment": "Malware payload", "value": "e8a5691810a49873d4bdccf6776510a2db6c17d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750503, "uuid": "9df7f712-4640-4282-ab67-7f08ef664d51", "comment": "Malware payload", "value": "057b37ebf9d0621a372ae6574321688c597d0029cb134f1fb5eabfcfbe9f7d7cfa6c86b487c34605dcda0abfb41ec826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750503, "uuid": "8722bfd2-3e55-4710-9a27-6a3defa8e80a", "value": "T12494F1123C7CDAB6C4869235606ACBF0A53FF86876251147B7583A1FEE783E21372749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750503, "uuid": "ba354613-9de4-4fa3-839b-77ca7c009d92", "value": "5ba12e6852ba82499f5822056a147515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750503, "uuid": "35df6ac2-d000-4d56-b589-2bee96094127", "value": "6144:lw/1POelIqtW+YPjXbs0CsgEn4yr2BdjRbv2ixvD3OR6DF7DSeFr7knGyHM:lw/1PmPLssgETrA5Rl66VS+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750503, "uuid": "86755bf7-8f90-48d4-9816-710e02722916", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750503, "uuid": "893531b1-8fe9-4de0-98b6-1267b7fc102b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750503, "uuid": "5bedc2fd-2dd4-46a5-bcc2-70ac79b17904", "value": "09614e70ccc217403b852420ff7c9a94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b22c45c-fb63-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628768864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628768864, "uuid": "727f832a-fe0b-4944-a6f5-1d744f3cd8fa", "comment": "Malware payload (Cerberus)", "value": "6f63a6f1242cc01ef15cdb6014098f23", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628768864, "uuid": "4dfbbc1b-b825-4dd0-bb26-0de2678a4d06", "comment": "Malware payload (Cerberus)", "value": "a9ff6425c1bb38b32f8570f5d2111c19d7e5bf3257fdff325993acf2e016d2f5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628768864, "uuid": "9d9394a8-2844-4720-b77d-54a503e586a9", "comment": "Malware payload (Cerberus)", "value": "691bb94c48bbb8b29df644751fe19f8840abd588", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628768864, "uuid": "46f4ef40-3627-424e-b64a-410f8b5b8848", "comment": "Malware payload (Cerberus)", "value": "5011a134d7048b4e7ece1b82f85f9d4fa43aae2a3aec13b21f3785f88abdc941b9300b20e539f622c1881c367e0b7380", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628768864, "uuid": "0ba02a9a-d652-4465-aab5-053faf020205", "value": "T1F8D302AB2355A0FCF6BA06758B9923753737CA41ADA69B4F002B47028E5371A5F64F0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628768864, "uuid": "7225f20d-6efe-47aa-97be-2781bf064f02", "value": "3072:tMvIjwInQxwiNxVf5pU6G3XMLZq7qIJOtJOU8485wA4zbwA4znUlvDm8VUlvDm85:tYnxwGxVf5+6GEZq7qdyFBGA4zUA4z8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628768864, "uuid": "1719b854-ba90-4d80-b9a4-b803ad168dd5", "value": 139999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628768864, "uuid": "552bf5d6-afd6-488c-8171-abdff1bc7c46", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628768864, "uuid": "e34d7af5-a222-4171-a5a7-f1f05c202ed4", "value": "AndroidGuncelem.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ca2141-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628775827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775827, "uuid": "fb5aa3c5-14e4-4ace-85ad-ec1370f7fc51", "comment": "Malware payload (Smoke Loader)", "value": "89c3336ea6ed1ad75668c067912e7305", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775827, "uuid": "6830b8a1-91f1-401b-8b47-9a2a913f0ec1", "comment": "Malware payload (Smoke Loader)", "value": "aaa3cda8d3f4bc7ff94a3e4f0fd37aced9d484b663bc15f198e6e25482f60443", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775827, "uuid": "20edff23-7676-474b-ae29-afa74c881284", "comment": "Malware payload (Smoke Loader)", "value": "2de13b667bbca2e1f0f4477007a644c09a86e533", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775827, "uuid": "8e263705-c008-490c-89f1-a9c6ed9140a5", "comment": "Malware payload (Smoke Loader)", "value": "2b351c6ce2fa95c5d00b3b07d682ee9e44c32ca6618fa4bf75157b793a6b572c0a1049d37eb5a027cf8c904d469889fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775827, "uuid": "b93c677e-ef76-4e70-aa6f-222730fdc99a", "value": "T14A648E30AA81C035F5F602F849BA937CB52C7AA15B3450CF92E52AFE56346E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775827, "uuid": "b25b0009-df60-4550-9f57-271f6a308bc1", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775827, "uuid": "72d634ff-9541-4158-9eab-ad9ae29fd0b1", "value": "6144:nuqgQ9xjvZVKC1v8o+v2HI5eERtfcWVJKZmEHZ1t5w:bgQ9xXKC1j/HIQE3cO6Zzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775827, "uuid": "9f8c0d38-36a3-4718-a776-1fbbb316a9a8", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775827, "uuid": "d5d162bc-ee0b-403d-abd0-b95d4c729df9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775827, "uuid": "4fcffb29-c92e-4aff-b712-6d030af1adfd", "value": "89c3336ea6ed1ad75668c067912e7305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70e3977-fb6b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628772561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772561, "uuid": "a0b9b27f-9422-4fd7-a074-77a39491316a", "comment": "Malware payload (Formbook)", "value": "2d401eff3fb7e3d78d85727e0235e5c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772561, "uuid": "689ce1f6-7c6c-48b3-9031-d70254b67f87", "comment": "Malware payload (Formbook)", "value": "ab4795f656b54e9388c89d6a4df52747510fa418bdb50aa3bafd7b332ef1ff81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772561, "uuid": "a120c26c-c9a1-43d3-8cc9-0e04d4499959", "comment": "Malware payload (Formbook)", "value": "70dfa677d8e1009ad21271b4db00297291cf35d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772561, "uuid": "c6e84b8a-47c1-4615-8987-b67b510162d8", "comment": "Malware payload (Formbook)", "value": "6609bb665e2d3249eb824296506a3d5232d5a85d40a0caaf8cf821950d17775dccfdc57bf30800fee2de8be6156adabe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772561, "uuid": "ae27259f-aada-479f-b2b2-ed0192667927", "value": "T10355A13D6AB92637C066C275CAE19817F05098AF31D1AD7CA4C65F26C7D2A5331C32EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772561, "uuid": "2b7e4bac-441d-4959-8233-7ba8d0e9d91b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772561, "uuid": "209ae062-4031-48dd-89e8-5fd7e2a28d43", "value": "12288:5oB0gKu/u5h9MCfKNeSxLL+OGaO2zYGQiOv7pXMsfvA4/Kzt16RDQ6H+Uy1Susr4:u07u/AMCfWNL+J5v7JMsGtKUZZS5R07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628772561, "uuid": "449add62-b4d3-46a4-b21e-2f8ecdb8dd8c", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628772561, "uuid": "2b3bea3d-2205-4094-a584-47331fef1cea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772561, "uuid": "52f82951-8a3d-4d96-bf12-dc71eeba5648", "value": "12082021654654,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b4bdbf-fb6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1628772723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772723, "uuid": "c7c83aed-dba9-420c-a5e5-7834ffb0fc71", "comment": "Malware payload (CobaltStrike)", "value": "ea9c6921f9690aa2193b8b613ca0e6e3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772723, "uuid": "caf93cf6-6bad-4285-b811-0d5f8bf6aad4", "comment": "Malware payload (CobaltStrike)", "value": "ac2041a6a46e48abb6dacc8de6b42176bbba7297c53b628606909938f502992a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772723, "uuid": "fb9a296f-3eaf-4ff0-98ed-52349a840670", "comment": "Malware payload (CobaltStrike)", "value": "20d25c672bf44a49af4d5d665f5d190d9c82d700", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772723, "uuid": "213ecc94-8bfc-4a94-879b-646b41e096cf", "comment": "Malware payload (CobaltStrike)", "value": "24bf0d9e6bbcac0ab0371a96e63fe5501ab96cc70419d650b0373835012697478eadac29e0dde6d913df3e374db7991c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772723, "uuid": "1faa3cab-bfa5-4d7b-b21c-ce4f97b761e4", "value": "T15644E09895B16777122D3434AE0EA8E8A5BF11CF65D06ECAC9BCAF4D600C5FC9C36187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772723, "uuid": "2384ebba-b3c4-4780-abfd-c4d1c5a10b36", "value": "6144:QlR7P6NzlnNv2AlTDSUWuvn2AQfYfXVJhyxL43l2ZzW4:QjPezlN+AlTDSUWuvnKfYflJsG3l2ZzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628772723, "uuid": "058530b6-0b83-4200-9257-eea705c974d8", "value": 260679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628772723, "uuid": "d1d894b3-4560-45ca-b74a-3c9671ada19a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772723, "uuid": "19af0604-f118-42e8-bc71-8baaaedbd56b", "value": "yz73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f14bf6-fb11-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628733745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733745, "uuid": "13da9ac7-a2e8-474b-b51f-5f31d89b17ea", "comment": "Malware payload (Loki)", "value": "a4679d7335c18da7e3b042fefbb09262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733745, "uuid": "4a7d19e3-39ba-4e03-b038-82df57acc407", "comment": "Malware payload (Loki)", "value": "ac4a470326858948bd6e8d28e2d8b0751b3b0ff61e882501bec8e434714d9a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733745, "uuid": "9a9b55b8-49ef-42eb-9537-3ddd107d9e26", "comment": "Malware payload (Loki)", "value": "460ad21c1cd86441f227e51f3a0e218edca4c6c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733745, "uuid": "784f5eb6-ccde-437c-b0e9-7382c7d4f385", "comment": "Malware payload (Loki)", "value": "0d299219ba475158aa9cf303b63886ba7a77e45dc50707b39a9067e3312dfd6b2fdef4e7b49ddc9770340b3d20697479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733745, "uuid": "b09ddd0f-876e-46fd-a581-da17a181ab0f", "value": "T1AD55B33C29BA2627D07AD375CBE59827F4509CAF3151BD94A4CA73260376B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733745, "uuid": "ab68268a-fc63-4ce4-b63e-657c7fe74078", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733745, "uuid": "40fa488b-4d7b-4607-8669-42d75f33089e", "value": "12288:bPGWmKBB98drWJg7+SS+agl54ZGLaJDSgAzT2fXQk/HmUVpJ03EVinI:bPZmKXqrAyxaglKKaJDSgAzT2fXQvOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733745, "uuid": "bbbaa399-9f94-4516-b581-7885a3502a80", "value": 1358848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733745, "uuid": "b1d4b37b-a0dd-4df0-b8dc-c16a10786ecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733745, "uuid": "1fdb9676-a5a7-4334-ae41-c26dd28952c2", "value": "340002751NIAHOB1087830,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d413a1ba-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767456, "uuid": "1c0b5464-f6cd-42a7-b73d-d1b51ee1776a", "comment": "Malware payload (Nitro)", "value": "a9e2ab65d7f6faa65564ad05c5227246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767456, "uuid": "f9308b0d-d888-49d9-a466-04f5ccb7cf4c", "comment": "Malware payload (Nitro)", "value": "ac8d46d555122c2f076e0804c0a588ee0f0a3183f6e4364394e5a4c61a1a10eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767456, "uuid": "368fb209-9955-42fd-8c9e-1942e22d080e", "comment": "Malware payload (Nitro)", "value": "f08915e84cf8831ec354c161689057f8d5ba23a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767456, "uuid": "35b40886-93b9-417e-a9e6-cc5c989782b7", "comment": "Malware payload (Nitro)", "value": "2f3dbccaaa6a7074a06d42b2213473435e7cdde5d7b79642d1483613d21a0c7712b32e539c3a01d5026dae432858e0be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767456, "uuid": "ef7aac57-754c-4767-b889-76bb5e65215a", "value": "T12E5364286173892EC86C81B815FB2FBC1BB0AF156460C79D4A78D26C3F677B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767456, "uuid": "a7b1b301-fc0e-4385-a6ee-feff2d7c580e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767456, "uuid": "234076ff-98df-4f97-8349-6245566b34cc", "value": "768:Z6gBoRjl0Gjru+A4YyYAwya9LDwUzc80gmq3oP/oDR:Z6Fl5jy+A0Yrywr/0O8/o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767456, "uuid": "d431fc81-953e-4579-9f8e-03a278934604", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767456, "uuid": "de03e544-8e51-47db-81cf-ec4f34e7799f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767456, "uuid": "d1afb9e6-adfb-415e-8cb5-529b11ed0080", "value": "a9e2ab65d7f6faa65564ad05c5227246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710cb9f5-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766860, "uuid": "26a90a46-ddb1-4b97-a0c9-cd01c138363d", "comment": "Malware payload (Nitro)", "value": "2ffcd2d62a573293c8679bfd606677b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766860, "uuid": "d5c51450-03c4-4de9-9167-7146159a972b", "comment": "Malware payload (Nitro)", "value": "ac8e4901e87d530eeceb6648dcf1d72787018a9116e87bbf2287644e2be50546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766860, "uuid": "b2775631-3ae5-4801-9507-21ee70ccaefb", "comment": "Malware payload (Nitro)", "value": "d72c5ffd540eb4273dc479e5adb1e39ce1ff0d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766860, "uuid": "f80c701f-88c8-447b-82f9-3545651b5744", "comment": "Malware payload (Nitro)", "value": "a1d02f674645b842469e1713bc4e26b9c9612a2c8576e3320a05cb73a6bf22b0443294508f61acfafa178fd8a99e564d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766860, "uuid": "1e9cf9f2-a271-486b-abfa-9dfb85151ad2", "value": "T151630C6862B6901ADA5C943861EB0F7DFF702AA9DC11D7CD4F72E0DC2D517B68AB0342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766860, "uuid": "703573f6-7881-4948-bd46-2163e83b0acd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766860, "uuid": "84591b0a-b65b-4aa0-a0f0-0bc32285ad85", "value": "768:WrC4jorKyMo9HgkbZSwk0q2HR/h765qg6:mC4joeo9XZSws2HRJM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766860, "uuid": "09702311-3133-4ae9-b3f6-e153e6ef8a22", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766860, "uuid": "625b59e6-b61b-417e-a7b4-6a11923784f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766860, "uuid": "f97b54dc-8303-4f08-a169-dd4be6c8e90d", "value": "2ffcd2d62a573293c8679bfd606677b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667cc3d0-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767272, "uuid": "727ad0c1-3b82-4051-a508-26c37d28f3d2", "comment": "Malware payload (Nitro)", "value": "765d13b0f03b8c3bf9fc8d34561deff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767272, "uuid": "6ad3ed0e-6810-486a-8e31-ea46308bea54", "comment": "Malware payload (Nitro)", "value": "acd9298cd8cf2ad1fff620e55792e33dd593ed587556324bb617209882a9b7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767272, "uuid": "9b3cfe5c-8d09-4591-af55-db0a249f945a", "comment": "Malware payload (Nitro)", "value": "73f9a1f43e3840ed6f67d1c40a1fd1b062a008be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767272, "uuid": "f5b61594-a750-40b9-8bc7-40bbb1ac8016", "comment": "Malware payload (Nitro)", "value": "8d17a47552f9957bae4cae34358c42a5959e0e04128230faf55341902e7c1627c78939c93c83a4cc1f93b1459047b52b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767272, "uuid": "d5da3f19-9ada-471f-9c52-3a356a289092", "value": "T18513D001BCECA263D3EE57BE88A2670A47E923A51111DBCF796970A21D2A7F0141B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767272, "uuid": "6884854f-648c-49eb-a261-5aa787ea2379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767272, "uuid": "972f83c5-540e-4194-8dcd-1c37b81e92bc", "value": "768:nsroiZrnrZvS7Xn00IOeSL8bOIky7SuMc3MyYVk+mqRsuHAY:nsroQlS730dSG6y7SuM0n0kkPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767272, "uuid": "403f4f7d-bb42-4d5c-a286-ed08f8d6aac1", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767272, "uuid": "acffea20-32c0-44e4-9017-89a9222ea12e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767272, "uuid": "4469d78b-9a53-4f1c-a8ea-59b2a80bd165", "value": "765d13b0f03b8c3bf9fc8d34561deff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59cc78f-fb01-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628727086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727086, "uuid": "2efddbe5-f5be-463e-b517-db306b687b81", "comment": "Malware payload (Mirai)", "value": "662076f487e749851412ef4d05e5b32d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727086, "uuid": "610bbcef-2b19-48ed-b3f6-484b869b0945", "comment": "Malware payload (Mirai)", "value": "b0b34368ede86b5ad481ed4eed6ea97fd7db1e4a36c6db7665a7797f7ccbad1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727086, "uuid": "32a44fc1-26da-4c5b-9be0-eee12837d48c", "comment": "Malware payload (Mirai)", "value": "0c33a26658025eed52eac731542a9fdd90a1cf79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727086, "uuid": "ee722db4-ecc1-408e-94d1-b03e48afd71b", "comment": "Malware payload (Mirai)", "value": "b73bb23eabd11c57d6e67395f02cb01b6280d53e069e3ba7ac2414384b84b92b3ce207aa8ad530b0abca9c30acd3a319", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727086, "uuid": "2a6d8a32-bb49-43f7-a02f-578107c7c347", "value": "T10D639D3AE40A9DA4C0424634B0E5DE361FA3A9C443272D76AFE442B61803DBCB55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727086, "uuid": "89bcf10a-4efb-4e22-9ab2-ce0114068ed6", "value": "1536:wam7dIbOF5lwtHAlp8vnt4c/NrzHT21+hsCDR:wPubOPl0tjTg+hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628727086, "uuid": "7f28011b-97b5-4ae1-8b32-fc69211ee891", "value": 66968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628727086, "uuid": "d02a0e88-5277-449f-8d7e-8831feb9d03a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727086, "uuid": "53093de0-cfd2-44a0-ad9a-e80e5881638e", "value": "662076f487e749851412ef4d05e5b32d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a381438-fbbd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628807705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628807705, "uuid": "5998d8b0-2cbf-4fac-8bb1-e40dfeebbc19", "comment": "Malware payload", "value": "cebd70129181b2d00175a09425028661", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628807705, "uuid": "e7da3017-546c-4c65-9a59-60b2d5bd74e9", "comment": "Malware payload", "value": "b0e0893c4a07b3a6c42c33988741f24c283be68927f79e0388e30d91eed7e2c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628807705, "uuid": "9dcc50de-fbfe-4d06-b800-bbcfab703f4c", "comment": "Malware payload", "value": "6412c81a57eb3e491d140cbb10b507b8f5086421", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628807705, "uuid": "26165900-567e-4865-9b16-8776b8141ef4", "comment": "Malware payload", "value": "26293e117dfbcbe47884e01eda1baabfcb44039849dcdfbda1b9ae2c366893f523d1db77ecf1f9d1da0184d2a3bf9e68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628807705, "uuid": "71c0e223-deff-4600-8bc4-1c7ae756f4d0", "value": "T16A648D30AB90C035E5F612FC45E6A378AA2C3E71973490CF52E51AEE56346E4EC3179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628807705, "uuid": "a154e263-0702-4d4f-8f8c-9c9d28a279ac", "value": "62f5ddafa2c16d26eaa8112b2787e21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628807705, "uuid": "028461de-7c4a-4635-a6a1-ee0bc0304922", "value": "6144:KN4z5x2rNAo0eQ2sCTQ6UGSeywoFaVt4Co5pZRtW2JrMNk:jz5Aqo0eQOTQ6N0nQt4j/ZO2Jrkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628807705, "uuid": "8446f397-6d3a-43de-9a57-0705a59e6224", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628807705, "uuid": "af42dde7-5fbd-409a-839c-a3cb9473376d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628807705, "uuid": "eebce162-48a9-4997-a982-2c085fca83a7", "value": "cebd70129181b2d00175a09425028661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcd4dfb-fb1e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628739424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628739424, "uuid": "adcc75ef-0a09-4629-b928-2cbc35159642", "comment": "Malware payload (BitRAT)", "value": "da9812a342b10c1429a60af815cc85f5", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628739424, "uuid": "1a34ba65-ff7c-46ac-9423-555553bb2f57", "comment": "Malware payload (BitRAT)", "value": "b16a424da66859604542b125c1db27fedd52eb23db2d7459299849408c739d71", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628739424, "uuid": "26e5b14e-4299-47c2-9323-8be530e5c0b4", "comment": "Malware payload (BitRAT)", "value": "3a81dace6a19ccd2564564c90e92099addcf539a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628739424, "uuid": "bb028939-5fa4-424f-ab75-b43fea194f0c", "comment": "Malware payload (BitRAT)", "value": "115e4c2b42987d240b7843311ecfe02fd010c44769f6f6c37b315d2c7e99d06aabba028530d79920a7bdaf059aabe3ff", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628739424, "uuid": "a9143be0-50b7-4560-b405-8e37c66187fe", "value": "T183D58B3C29B9262FC066D675CBE59823F4009CAF3212BD55A4C73366437AA5779C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628739424, "uuid": "f63cd1e4-4ffb-415d-b2f2-40ef9dbd2baa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628739424, "uuid": "966077e0-688e-4860-af2e-4e0a8ad9d731", "value": "49152:UTCl/+XjmjnJ1vN0kGOWmSPrH+HVGvzzRUc6lwuZ1cT2/LRS:2O/jrykGOWmSK1AajZ1c6T0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628739424, "uuid": "bc7a2b5d-978c-499c-9b87-9d4a26eccfbe", "value": 2800408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628739424, "uuid": "0b113b47-9ad0-49bc-8ec3-e33977767c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628739424, "uuid": "22099790-90a0-4b0a-880f-bd34695c61e3", "value": "Order No 93459674 Specification and Dimension.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972fca78-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628775944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775944, "uuid": "fef3caa8-ebef-42e6-96af-e17d0d462eb2", "comment": "Malware payload (Loki)", "value": "d8bde6bc190a6d9af06410f07cd347d4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775944, "uuid": "acee5a50-58c8-4a8c-a87a-a9d0a33a16e1", "comment": "Malware payload (Loki)", "value": "b17b9942c16dca4e99e6598e31255bc11d36a85ae0c7aad08f43b304c48ebb39", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775944, "uuid": "c37cfeba-073b-45ec-8e52-b52a9d30ceff", "comment": "Malware payload (Loki)", "value": "ab4ac9280eeb7bf9eb81f6d1306138b614274f40", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775944, "uuid": "ea7c26b5-9daa-4a4f-b5a6-ac36d01b323e", "comment": "Malware payload (Loki)", "value": "c6137c412a4daf893e779b8d36547695db1b8b691bd957b60746c0fa0381ad62f2c4a45ef1cfbed3e6e90a40e24f9cf3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775944, "uuid": "05ba081f-7bd6-4f97-a457-77d7babfb307", "value": "T1645522F06FA02E7CF9AB13B69CEFCB7935355C94F186585A3158220E04B2374BA5B325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775944, "uuid": "b28748a2-4324-42ae-9b42-346651e8b484", "value": "24576:GjTROm338tetrWG7wM8ADb1o+6yraRLfdbX8NB0qD6KEsEPu1E4x2N9Inq6ED:mTROejcG7wM8ADBoFyOxFX8EqAslhxop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775944, "uuid": "d14568ee-8ec7-4d83-93e5-963fe663100e", "value": 1372728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775944, "uuid": "a65a9ff8-1360-4387-ac49-a56a53b48c2e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775944, "uuid": "08025951-d6c6-49e5-9036-c53e30e1e3f8", "value": "TT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41778742-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767639, "uuid": "17eefaaf-c255-4575-b50b-ecb15dea8705", "comment": "Malware payload (Nitro)", "value": "cbcf9db19f980d9b5232345242d981fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767639, "uuid": "425c37d7-dc79-45d7-b260-dff0f51e65ad", "comment": "Malware payload (Nitro)", "value": "b244fa001f1f45246b4608fdac78f80988ad60150aa08e7988fc5dbd37e323ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767639, "uuid": "b5fc2e59-4f8b-433a-b2d6-1b8f2fc0bbb3", "comment": "Malware payload (Nitro)", "value": "0f119cc4df6ea8a861141016e595f99da295b16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767639, "uuid": "ec5a9024-44f6-4bd7-8abb-7198b478039b", "comment": "Malware payload (Nitro)", "value": "18486dc2942fd94edd7addb2d518258441ed4f7f0c8b2b569a579697996eae7b43241c6e4e842327a717bc33a1122126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767639, "uuid": "69cafaa7-615b-4195-9a6e-c258b6ef607a", "value": "T1875364286273892EC56C81B811FB2F7C1BB0AF565460C7AD4A78D26C3F677B6CD10B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767639, "uuid": "10403b79-8fec-451d-8686-e732bd7c85c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767639, "uuid": "909486a0-2542-4677-a918-a5dcc47f5247", "value": "768:5OXeakeRbRW3DNANIhrtLvLDwUzc80gmq3oP/oDU:5OPW3DNA8Fr/0O8/oA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767639, "uuid": "f042bbc2-70d9-41c1-800f-f17a0b646acf", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767639, "uuid": "76b5f479-a3ff-45a1-a7ba-d2ffe19586da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767639, "uuid": "5833c67e-554b-4e1a-a8ab-8af24d02e915", "value": "cbcf9db19f980d9b5232345242d981fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42138cf-fb68-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628771295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771295, "uuid": "68f4c453-6460-4735-9b62-f6af701d4eb4", "comment": "Malware payload (AgentTesla)", "value": "4494b2b76c93a8eaf0c95fb04c7eff70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771295, "uuid": "78f9e5e2-1891-47ea-a3e8-32043dda0211", "comment": "Malware payload (AgentTesla)", "value": "b2d0646c000d113ebaf252cf3d5eac243608b1358c653e7ec7fd85880cf1f5d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771295, "uuid": "ea18a619-bce3-4a35-bf5e-ba161205bc6c", "comment": "Malware payload (AgentTesla)", "value": "3f851cc1f324d316a341d8113f9ccf8021ee7b4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771295, "uuid": "3ce8fa8a-bf14-4c25-952a-162319329922", "comment": "Malware payload (AgentTesla)", "value": "8a1ba06c6358f3eee8179597e7bb5daa83640cd4b1c913cca0066a6edf122fc182f74fc72ca40ee6a0bd4c3be2389597", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771295, "uuid": "84430f96-0771-4087-916d-2731216a3051", "value": "T1C8755C3D19B92637C0A5C6758AE19817F0449CAF31D1A9BC94C27F66C3F2A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771295, "uuid": "16ac3045-74e3-4765-87c3-2abfe7ca617f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771295, "uuid": "d1415450-ba04-4d35-83c9-0ff4d1a6b754", "value": "24576:bZhWmQaCOpzry5nKE1BXLUbwm4EZZS5R0:P4Opffiqwm4E3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771295, "uuid": "1c735d8b-d664-4fed-9ca5-0af9f2f1286e", "value": 1609216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771295, "uuid": "c4b0eaa9-7118-4570-bf33-4591008bd4f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771295, "uuid": "f86fe957-2249-4715-bf4b-a5874b603edf", "value": "invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4bbccf-fb66-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628770238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770238, "uuid": "46550e7d-873b-406f-872a-414f7fe1c593", "comment": "Malware payload (Loki)", "value": "b0f971c078d16563fb83fad4066ec31b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770238, "uuid": "4333aee3-989d-4271-ac53-48a7cc083876", "comment": "Malware payload (Loki)", "value": "b2d561621fb51170080b646aa96ec14994a3882047fe0adc61b04a07cd618884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770238, "uuid": "550898e6-611b-4537-943d-1943078c9216", "comment": "Malware payload (Loki)", "value": "665456db184150ed5b0ec4974d43ad2a50406a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770238, "uuid": "9c66b532-bf1b-4b36-98db-d6b0de3edbb6", "comment": "Malware payload (Loki)", "value": "50b97fe8220b4347dd08adcfdd674446fb8f0faee0f110b950247b3038c4a8a5a0eb3c64ff55074f42544c8e6340d771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770238, "uuid": "f6d52377-c0fa-48df-8fe6-b1fd9b37626a", "value": "T1AA54E021B6E5C970D9F316740A7588365A6DFC724FAF8CAF33A42B164FA02D05934F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770238, "uuid": "b9354d5a-b199-4075-b4c9-e8018454444c", "value": "70dc986f89100eba5b0fbf299e1d4ebf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770238, "uuid": "da040698-6fa2-42e8-b580-7dc26e793062", "value": "6144:AIqYfzlR8NE20CLcE8/AhWUdmS4TTNEAtBUz9SIAS8XkzWo6PyFq/:Ax4zlmE7CLcE8uWUdmXnNEAbUpaUSoWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628770238, "uuid": "de2e4a06-817d-4a61-9bb3-8f24570bb26f", "value": 303554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628770238, "uuid": "b24a96d3-b64e-4558-9078-82a19db20866", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770238, "uuid": "c7c38dde-1727-49ec-96e1-c4f06a153fee", "value": "REQUEST FOR QUOTATION -xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22a40ee-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749387, "uuid": "3c1865c8-b20d-4991-beb2-014ff44bbbc4", "comment": "Malware payload (AgentTesla)", "value": "943d3e51c00b149d0fda61b891e6df0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749387, "uuid": "ac47a7ee-4674-4a49-85f3-0459d493f61a", "comment": "Malware payload (AgentTesla)", "value": "b3614ad64d0a66c943c9b6551740a47c85c64598faea2576540dd207ae089e09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749387, "uuid": "c13c18c3-771c-44c4-a005-6609890c36c9", "comment": "Malware payload (AgentTesla)", "value": "92bc6b96b3ec3eb08798dd518b6201424518b11d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749387, "uuid": "05f8b6c2-fa1b-4caa-ba8e-0132f0be63d6", "comment": "Malware payload (AgentTesla)", "value": "ae9542e59237f21703560f086e41bfca18660e282e723c3be53e3b8d6d1f8198bcee3dc1918a4bc5f06f957d8ca3607b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749387, "uuid": "39d24ff3-4d95-4943-ae07-62bf985fbc65", "value": "T1BE65D53C29BA2627D17AD374CBE59827F4509CAF3151BD94A4CA73260376B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749387, "uuid": "3314155a-ccda-40ca-8dd9-7bc68033d07e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749387, "uuid": "e339d28f-9a6a-4256-8070-c46d9eafc9e6", "value": "12288:E8av9lKYx0zWXf805Si0z+CSYNgrFTuOIgIa8VOLHT2fXHk/HmUVpmldEVRC7:E59tKze9VgrOFAYLHT2fXHvOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749387, "uuid": "b4720d39-ec7d-46a1-b0a2-49b178fd8d4c", "value": 1434112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749387, "uuid": "e75bc083-e4d0-4895-be4d-1aa72136c2ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749387, "uuid": "5a07f689-9d19-4d4e-be37-cbd3bcbd07ee", "value": "QUO210820210009223.PDF(121KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5117d822-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767666, "uuid": "acb5336d-33c9-4249-a1ac-668efd7fb68a", "comment": "Malware payload (Nitro)", "value": "d30e1c34749f25aa1d553bd54a479af5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767666, "uuid": "b97c2835-7c89-4b4a-8ed3-a355b711998f", "comment": "Malware payload (Nitro)", "value": "b4a34e66e4fa5d3e82874016ada5d3e1e640eefd9e578bd6264b4804cc398bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767666, "uuid": "c9118815-9b58-48c6-846f-f691a78a4534", "comment": "Malware payload (Nitro)", "value": "d4a2475cf62e99ed4dd9a1f23d8eec5de826a678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767666, "uuid": "ff972cfd-b60b-497c-9b75-727628734c81", "comment": "Malware payload (Nitro)", "value": "fd88e19e578acfa70f9413a82e2adf9e51c4071f313f1a79bdbfb5fbce41d42b7defd02272e13f749048e7fdbc4875bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767666, "uuid": "09c8150c-e8fc-46e6-8395-cc3d730847c8", "value": "T1C153542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767666, "uuid": "b5ad08dd-f049-4f8a-a532-6fff7870df76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767666, "uuid": "f17f04da-faca-4433-ab88-d4187f7c9a5a", "value": "768:YKsMqCXfVcWpjDMLoiANIUeQYLDwUzc80gmq3oP/oDT:YKseVMLoiAP8r/0O8/oH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767666, "uuid": "3d253b84-af28-4709-9030-3834b7986524", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767666, "uuid": "76ac44ce-2cac-402f-9cf7-fa22b6e0a761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767666, "uuid": "9c9e9b26-a2ee-4918-acdf-4d206ab8d137", "value": "d30e1c34749f25aa1d553bd54a479af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f5b4b4-fb6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1628772722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772722, "uuid": "187905a4-efc2-4a43-95ee-128b1d195ddb", "comment": "Malware payload (CobaltStrike)", "value": "b594afc619b7f19b04c125b093ddb099", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772722, "uuid": "5a5453c1-133b-4ea3-b7ba-7d282bf056ba", "comment": "Malware payload (CobaltStrike)", "value": "b4cfc49d647ebeffb99579dbd4be2a4ca779e3d36b60656aaa9d616ac343e991", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772722, "uuid": "aec87a93-cead-4136-84e6-91e3d28b634f", "comment": "Malware payload (CobaltStrike)", "value": "1e151a99c1b3e8f66f70e0174b957cc687c79984", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628772722, "uuid": "3178160f-7e27-4b56-ba35-3a71db1459c1", "comment": "Malware payload (CobaltStrike)", "value": "07109f452b65ae342dcccd3fb3d978bc5a439ca5c98700defe82c82acad6ad99e02da50b71a1950a3352469594d9100e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772722, "uuid": "136200f8-a299-4f89-bc67-3fc037d02014", "value": "T140C53A06F89204FAC57EF13085929361BAB17C6443313BD71F94BAAA2A76FD46E3D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772722, "uuid": "8e94e26a-5d67-4942-9876-9be2e9e2a470", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772722, "uuid": "283364a3-ca87-4287-ba0f-fc4f54502d3c", "value": "24576:lR5N5YQjiT5MEiIoSFfxnqq+/BIBRo/OWhUpH/f0HLa8q16:dH1jMJiIoMJnqq+/BIztx8He8q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628772722, "uuid": "a58d15f8-e9c2-4c5e-b066-b5cc4d85adcf", "value": 2600448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628772722, "uuid": "ed396b7c-d756-4e4a-9159-826eb145ad39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628772722, "uuid": "eaff958f-763f-4000-a21e-8c482f982fcc", "value": "b4cfc49d647ebeffb99579dbd4be2a4ca779e3d36b60656aaa9d616ac343e991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda6005a-fb47-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628757164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757164, "uuid": "8a14c243-8eec-4d8b-acdb-e6dc54f39e8a", "comment": "Malware payload (AgentTesla)", "value": "27ccabc6a0f595c9caabc79da04c750b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757164, "uuid": "33412efe-32e5-45cb-8336-90e6c8e7c44f", "comment": "Malware payload (AgentTesla)", "value": "b5648af3a78134f62d9385b8cb2408f155f7c253f515f08143ff19ed74992fcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757164, "uuid": "195dab04-5b4d-4fbe-beda-7a1b5c627b5b", "comment": "Malware payload (AgentTesla)", "value": "4565647af1304a21c2f82824cca73a4cc18f6acc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757164, "uuid": "7e6525e9-f9e0-4489-88d9-f56c3519e1d9", "comment": "Malware payload (AgentTesla)", "value": "edb821f2ea204e570026aff1dc89ab7129cfa1c4d9417e96e6575ee65f0eb3cb09b9b53fc7895d63651faab499191762", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757164, "uuid": "56732493-06d8-420f-96a1-507cc2b9f53f", "value": "T1F054F142B6E0D231E0732571466C99B79F6DFD34873F9DB7B744022A0EB06C08929F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757164, "uuid": "e7485402-3086-47db-8a31-2264b0f11322", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757164, "uuid": "bee04415-91fb-4ddd-897b-a019d222c1cd", "value": "6144:kA+fRiOnxOUhuz0XtKx+BdUVpkvfJ74aCNYnb:kA+fRDfxXwx+B4pEZyNYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757164, "uuid": "173ad7e3-4080-494a-a457-27822a76505d", "value": 306356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757164, "uuid": "d0e33d07-abae-4d58-afa1-b150abd34b03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757164, "uuid": "5a2144fc-2748-48e4-9a4e-0dc8cb3240ce", "value": "27ccabc6a0f595c9caabc79da04c750b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541fb6ce-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767241, "uuid": "04631f30-cbe4-4270-8290-c80ae54d2d0c", "comment": "Malware payload (Nitro)", "value": "101b558457868065952e67ed8db39e07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767241, "uuid": "c907518d-ed83-4b89-885f-89b28ef0ae67", "comment": "Malware payload (Nitro)", "value": "b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767241, "uuid": "189012ce-046e-407a-b04b-4603479be55b", "comment": "Malware payload (Nitro)", "value": "dd1e73f1d4539abf7f70c6cae16d8466093cf99b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767241, "uuid": "4d8355d2-cf30-4660-9e42-3af38d455971", "comment": "Malware payload (Nitro)", "value": "259f3e1f39310c4f570b937665dac0b53ee81651c9cb71170cf0827612c0ad39d083b921d9205c07070d11f93c3729ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767241, "uuid": "1292ff08-363e-49e4-94ae-6b6e5cae2ee8", "value": "T1A814487E36D58F11D65828B5C2E7A57403E7A987B732D7863F0812DA1E023E8CD9A7C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767241, "uuid": "237947c1-4f9a-426b-b177-dae4ff1dc34f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767241, "uuid": "8aa2a3d7-bf2e-42fa-8f71-b8d55bc1e8e4", "value": "3072:FJsyAT6sLPy3bY3ylNpFCJKZMlrREFwazl1V/ILnElcbTytIFuqlyyCfPH6Zxs/5:gyAT/D2Y3y/uSMxR4pbEA2ixpIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767241, "uuid": "ba897a3c-ba1f-4743-88c7-a4249850effd", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767241, "uuid": "9c7a1dc6-1fb8-4569-af62-2c3f9678f492", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767241, "uuid": "52364a80-bcdc-4904-8415-2ced42738c0d", "value": "101b558457868065952e67ed8db39e07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d2fe1a-fb45-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628756134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756134, "uuid": "fc3ac7ed-41a8-4816-bae6-5781f3cba884", "comment": "Malware payload (Formbook)", "value": "733f49adecf3d0fd0dd2677665b0c369", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756134, "uuid": "9aeda3c3-73f6-4378-a55b-afbe93f4a474", "comment": "Malware payload (Formbook)", "value": "b98429d0910af088452746a40124e498aa3c943ce450012c770c990788f7fc89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756134, "uuid": "cecf3edf-6211-47ff-b32a-77455f7b151c", "comment": "Malware payload (Formbook)", "value": "1b615d268159e18f518153cc742b772e7d0402dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756134, "uuid": "2f442afd-8329-49b4-b610-68dfd7a327ec", "comment": "Malware payload (Formbook)", "value": "95cad7a53be268da69b16e22b99e9b487964219a14f6e4a1751e59110dd32da16f39d732a4476ae2863593005f2deec6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756134, "uuid": "000de780-4cad-4f18-8e4e-0e0e51638266", "value": "T12884E04A16C242B5D1988E71B7FD62F842F0A73B9211F76F6D4452E4CF2270E9A076B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756134, "uuid": "1b151861-e848-4512-b863-9b5026bb8ba1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756134, "uuid": "bd26390c-29c1-45a2-81e7-5d648e494028", "value": "6144:cqEbugMZb8hOhInFPn7Exq/vuOWABq9VyichGH4GxV5HNG:ZEJGbSOht9OLBqZH4gVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756134, "uuid": "076977d6-2635-4847-b666-bcb1eec35148", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756134, "uuid": "0ee31bf1-90eb-4ba2-bcba-e3888bdb9f92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756134, "uuid": "bd0c5ea6-1c1e-468f-baca-d3c0d9b1dc6f", "value": "733f49adecf3d0fd0dd2677665b0c369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4538629-fb27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628743378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743378, "uuid": "7e253544-cba5-45af-9527-014343983738", "comment": "Malware payload (Formbook)", "value": "bb40168a6c252bf62ed7b928db2ddca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743378, "uuid": "6f721900-951e-4b68-a669-fde248a391f2", "comment": "Malware payload (Formbook)", "value": "bd024645f51a267c6d24a75649cb617ac29029d5e9f8a3d8aa8c44b44cf668c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743378, "uuid": "98f1e6f1-8f0b-4e6b-b0ce-e380a4aa8877", "comment": "Malware payload (Formbook)", "value": "fc0f23691751b63d93d6efbbbdb5ec7e01a07c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743378, "uuid": "d958e795-8ef0-4cba-833c-a9ead979403f", "comment": "Malware payload (Formbook)", "value": "e844db9ff41f75101ece888382c02ee3c820d9e76dfd3dc45c317b66ae39798dc753b464cf9de8e5f1145904868e0d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743378, "uuid": "550a80e4-e6a3-4ffc-9be3-0e3ce4e9afc8", "value": "T1BE340284878DA7C3D5C061F46299DE7F14798572E6EF5A636309B4010FFEAE0EA00E5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743378, "uuid": "ebd6b467-dfe8-4d2f-8a2f-9045c4ceb708", "value": "dc195339b27b4fd5a57110edcd4091c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743378, "uuid": "322bf8e7-71ee-4b5d-bf5f-cc810af20971", "value": "6144:A89I85FiKeBfbarbNyicAdmXyzLAGkgqBPp02:A864FiKedbAbzIyX3g7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743378, "uuid": "ef410e40-ada3-4e16-bdb4-f3b2622e34f6", "value": 241112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743378, "uuid": "8d8bf446-d51c-4881-92f6-c4708fb7fb78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743378, "uuid": "11cd2d4e-51fd-4802-8591-555f5dc28402", "value": "Roominglist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892f305d-fb2c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1628745426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628745426, "uuid": "8b0a60ee-a795-4700-96a5-1b7abd5afc83", "comment": "Malware payload (Amadey)", "value": "bd374f2e98ecd8a4355c762c311cdd2c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628745426, "uuid": "c14e6623-d3bb-4ff3-9a34-82b96a572747", "comment": "Malware payload (Amadey)", "value": "be63999b69ae9b9b9e44a622fb2fab35873e031c140749e52ba40f119bf58d5d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628745426, "uuid": "7ee35fb7-6cb2-4633-b26d-7548ecf530ad", "comment": "Malware payload (Amadey)", "value": "54da51cf584b922ca751a38ed90424b7fe161c74", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628745426, "uuid": "94d41443-41ed-4f61-b6f0-d464f8a9c7aa", "comment": "Malware payload (Amadey)", "value": "ae0a8978514dab95add7c9ea23dfa034d6a47873d9906c5c3535ca7840257e2fc87fa0e0dcca716ef5b879c8630ec38b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628745426, "uuid": "75f4189c-10bc-4b67-ac31-835e3666f8df", "value": "T11864CF317280F872E877C53070DE87A5FB64AC226B55424F2B993E3E5E73391536A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628745426, "uuid": "d5caa91b-753d-41e0-8e42-ce25cf727568", "value": "e167d9e0823b3034f406b282c3e2b91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628745426, "uuid": "c6f0f620-796f-423d-aca3-05ea8e43f59d", "value": "6144:wDMGQBlZvk5oHmjMcMe7f9OxWWCIwfZ+o:sMGQrmpMSf9u9C5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628745426, "uuid": "a84c15e7-913c-426c-9936-0a33cb27952c", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628745426, "uuid": "da8c32bc-d172-4b22-ad6c-9bdd53f6b94d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628745426, "uuid": "6722aae3-be72-4d43-8bfa-a361fe7c80d1", "value": "BD374F2E98ECD8A4355C762C311CDD2C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa720a1b-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767520, "uuid": "e6e68d64-3e74-47cb-9c04-6bc27b17ef27", "comment": "Malware payload (Nitro)", "value": "b0f5de53b7131c8486445c880a3efcab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767520, "uuid": "125ceb4d-60e6-4e20-9a71-e9b67f4cb631", "comment": "Malware payload (Nitro)", "value": "beaddc303ac98868c299807322cfda81ef519ecf452444393c5478a04e0cb38f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767520, "uuid": "56225da9-fcf6-43df-9a27-47ecb1636b5d", "comment": "Malware payload (Nitro)", "value": "c4bccf5722cda8d75254827715ce33259218cdf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767520, "uuid": "fa267cd7-1b87-494f-8c2a-88e22bdea949", "comment": "Malware payload (Nitro)", "value": "864cef224ffe21561c859f75430ee420db7f4e4dad7c9f13f5277a2505692b88ec4b33ad186cbeaf25050968b6c07ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767520, "uuid": "eb6afed6-77cb-4e5c-95c5-4179a34f4ed6", "value": "T13453542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767520, "uuid": "d4821535-886b-497f-8d73-9a3f5ca6273a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767520, "uuid": "05e3ff88-09f2-42ff-9269-20c5fe768d08", "value": "768:gKsMqCXfVcWTjM9ZkiANIUZ0hYLDwUzc80gmq3oP/oDX:gKsenM9ZkiAPZBr/0O8/oL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767520, "uuid": "29079afd-cde3-4f44-8593-b8aa9d8fa38a", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767520, "uuid": "be169fb2-99af-412f-a7b7-948ffe9111f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767520, "uuid": "30932c22-ad56-431f-8489-df3ea02a3844", "value": "b0f5de53b7131c8486445c880a3efcab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884df85c-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628775919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775919, "uuid": "15fa50f2-8804-4ab4-860a-d239284f1c8e", "comment": "Malware payload (RemcosRAT)", "value": "794c22eb8c00fb93fbd3c14c5208e2e2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775919, "uuid": "8921cd05-9374-478b-8fca-3363aaa440b0", "comment": "Malware payload (RemcosRAT)", "value": "bf1fa14c2ccaed571bac90e4e558904a71b35e6a295799a87078044f7e46ea01", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775919, "uuid": "1a596264-8c37-47ba-95d8-5a1f96bbddbf", "comment": "Malware payload (RemcosRAT)", "value": "ce6232072a8080fe1707671a76d12543123b3748", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775919, "uuid": "d1f85c52-323a-44bc-a598-6bbf553c18cb", "comment": "Malware payload (RemcosRAT)", "value": "dc879aacbfd4645176402fa4cebb47388887b059f0ee7e8ba0468c7c6a63212c91228d3ce29a519f30d8947d57aee956", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775919, "uuid": "f0751890-0f55-43b0-a795-f9e66abe26ea", "value": "T13B55120934781706D7F54EBBAB93BA727738AD434E4781062D86FE163CB5D380785EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775919, "uuid": "06816b65-e878-4aa8-baa9-2dd0390c165d", "value": "24576:GDQi1efnw2Pk9IJ7qwstm62YjPHtlqBpksoQHXexZX616+/ymxxy5/CsEuWirCf:GDQi1wwIJeROYjD8pVNcZqm6xyuuW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775919, "uuid": "86a18266-eb09-4ccf-b50f-5fcbe42691ac", "value": 1316632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775919, "uuid": "bce36f3a-c653-42cb-9a34-0125b30b4664", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775919, "uuid": "e7ee99dc-cba2-4b2f-bb05-f07f70612027", "value": "JUNE -- JULY SOA---- Worldwide Partner--WWP SC+SHA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f91e958-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628749275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749275, "uuid": "59ea090e-5620-40d9-b74c-86bcc1c6822f", "comment": "Malware payload (Loki)", "value": "85b0de76fb89e50348b02b6ad72925ff", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749275, "uuid": "65d20f11-5808-48bb-b2c4-5cc2883c5a73", "comment": "Malware payload (Loki)", "value": "bf4f5431f4556ef240e6f9084268e17d9417453ed1d9593bcfcf6535fb97c80c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749275, "uuid": "406e20ba-2604-4ac0-9e90-e1537139df77", "comment": "Malware payload (Loki)", "value": "0b76fb0ab558cce65282af9ed9f153cc0ff43082", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749275, "uuid": "469d05b0-8789-45d0-bb28-2ba3cfcd47a4", "comment": "Malware payload (Loki)", "value": "f49c17c4035d554faf25ef556ebf7a59cab87b1605a4d67d57d9b0526b4590caf68514b270a2be575a68d29ee91c189d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749275, "uuid": "2c718ab2-8f2f-45e5-90c9-1e338e157a88", "value": "T1884512453ACE2537C70A1A79520F81E0E7368DCD9BFAE996FE47B46016B12D10CDE29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749275, "uuid": "751eecbb-b509-4fd3-8611-4ce1804ebda8", "value": "24576:Ab6L0mAVuqAnDB0LI7TSHBHaczR/On8z8pxAmlALopn7V0/R:v0mxnDGLqTU4Ig+mFn7V0/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749275, "uuid": "83036367-b9eb-4e05-8e82-6cd97450c048", "value": 1268648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749275, "uuid": "cb9860bd-41b3-413f-90d3-77b63dfe2efc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749275, "uuid": "67c55a74-9a00-4da5-a4d0-efe0dd20a4c5", "value": "MT ANTARES.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda57c5f-fb01-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628727072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727072, "uuid": "0968a4f0-6435-4edb-b471-b80c1494915d", "comment": "Malware payload (Mirai)", "value": "f49b03fedca5ab76f35f2f8ec262ae9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727072, "uuid": "b3b51f97-eb97-47c9-898a-3fd043feb948", "comment": "Malware payload (Mirai)", "value": "bf549cd53d649755fe4d4107c5a1a2b9b0a047c565c04da84f11ab882914bed4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727072, "uuid": "14cc3cd3-5779-42be-a99b-fcec963b9a90", "comment": "Malware payload (Mirai)", "value": "b922c9567261575dec0c3f162675184364f4b747", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727072, "uuid": "b6818784-fd71-4e87-90c6-647fdd0b5e58", "comment": "Malware payload (Mirai)", "value": "61b2335c57f7acf6cd678e30ef394717e76b08012c71f29cc6e4c386d10abed9b1efc693d9ef7376c17d77a67abc5c96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727072, "uuid": "52c5ad3e-004b-4804-8c10-6a534694a238", "value": "T18C83F855B8818A11C9D512BEFA2E118D331267ECE3DF72139D201F643BCA92B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727072, "uuid": "031eb4d2-4e2c-4844-bf61-561e5e487e82", "value": "1536:QWn3dfYbDT8+05UAlStSGevTHv05cR7ch5i6H1oXK/w5e5l995/RGcsIAiScGHbd:L0T8/5dlTGUjv05c9c3pHm6Y0nScGHb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628727072, "uuid": "ed84f8ce-09de-4644-86c7-c2824a74c4ef", "value": 83552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628727072, "uuid": "c249fde8-30d4-42c6-9513-0a26ed349c12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727072, "uuid": "ad666947-0db1-4950-8cc0-e1170fecc15b", "value": "f49b03fedca5ab76f35f2f8ec262ae9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00851008-fb55-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1628762806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762806, "uuid": "fc384839-0c49-4326-8c1c-a138839dc40c", "comment": "Malware payload (Glupteba)", "value": "fa40580cff0aca1c2ee922ebcaf185ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762806, "uuid": "23dab814-3501-464c-bbad-30c5c42d7503", "comment": "Malware payload (Glupteba)", "value": "bf5bc18439ee4363f861058f1dc8a0fa74775be6efc44fbf7d8d6c511fd2a447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762806, "uuid": "a10027d0-7c4a-42f7-aeb6-a84281955dda", "comment": "Malware payload (Glupteba)", "value": "d0ca27f2d8e6b81947db9fc1a6b405297beef868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628762806, "uuid": "c1bda2c4-8b70-4844-aee9-3fa3a8f1592a", "comment": "Malware payload (Glupteba)", "value": "8518533104a251859550f54688e4d17000d6023075597f255079bf760601ba1ef80dd385bd65743ec759a11779cbbe8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762806, "uuid": "ef19d0b9-1ecd-48fe-9df4-c63fa2a264e9", "value": "T152263331AA60D878D8FB52FC41F627BD55293FA0DB6040DB45E806FE5B283E19D3178A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762806, "uuid": "de3a5d0e-9af9-4ebd-86ae-30a379e2e8a4", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762806, "uuid": "aff33567-1644-4c2d-9476-b4902ba498f3", "value": "98304:argRwGt7eme6jWyULYgwHUUVYhW1djzfoXMMFe8D/cqqom3IaGwifndl:aMRN7B+yzVU9hW1eMM0e/BPdaGZPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628762806, "uuid": "218fefe8-c01c-4375-ba56-235324e5132c", "value": 4707368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628762806, "uuid": "78e0e4d1-42d0-4d39-864f-3a3e6bb84713", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628762806, "uuid": "aa7b27bb-b1c1-49e7-82bd-4bdafed2ff6a", "value": "fa40580cff0aca1c2ee922ebcaf185ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3642c03a-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628750441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750441, "uuid": "2d1acfaf-4615-40d6-bae7-13176dd93257", "comment": "Malware payload (BitRAT)", "value": "586f79d31e3b60f3737c247810e56612", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750441, "uuid": "191924fe-aa3b-4ff3-ba5e-e0eaab53d257", "comment": "Malware payload (BitRAT)", "value": "bf6b69cb7063d748e6404300ed8b587473b20b2239605862ccbec909bccf7485", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750441, "uuid": "48fc0829-f364-41a8-a1cb-d0cd217afa94", "comment": "Malware payload (BitRAT)", "value": "ec148bed94d3a4e9dabe517533a74b6021d02fef", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750441, "uuid": "11b12289-5e64-4444-b8fc-d17951a7af00", "comment": "Malware payload (BitRAT)", "value": "802bc44759066d270b1534b7906b20a0015f065b90b33a576b13ef4acc6c6e527118853c22f3ad5d8ee06e92bf03c9e9", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750441, "uuid": "1f2fb31b-572a-4e8c-80af-6b249934fb2e", "value": "T1D69533073F1995A1D248B233C5D314740FA3EF81516BEF4BB68EA71632173DA9A0BA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750441, "uuid": "b7ccc436-89b5-465f-ba79-be414421742a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750441, "uuid": "1301e040-e8e8-4fa3-aec0-8cc1c5d1f87d", "value": "49152:V2GnkYpnt6j4Va7ep3sQDHDdtf4NN3cpbV:Vk0y4VoeN1DLfiKbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750441, "uuid": "1fec67c7-6206-4c79-ac0c-f5273602b673", "value": 1880064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750441, "uuid": "dd6f3588-d526-433e-90d0-fff7a2e69fae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750441, "uuid": "521edb1c-ad5d-43c2-b8c7-4ea058a40ea5", "value": "586f79d31e3b60f3737c247810e56612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2028377-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767399, "uuid": "8e19d2db-8caf-495d-abee-30a6548fcd97", "comment": "Malware payload (Nitro)", "value": "164651e3f142e4aec14ea0716a217064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767399, "uuid": "c50873d1-fc59-424a-811a-796b2728511c", "comment": "Malware payload (Nitro)", "value": "c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767399, "uuid": "a63731b6-ac73-4895-ba60-f162b9c81ff6", "comment": "Malware payload (Nitro)", "value": "63b608ba0c59407c312a83ee788392c99bc13642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767399, "uuid": "6b968d5b-6204-433a-b3d5-44a26d1fd3e2", "comment": "Malware payload (Nitro)", "value": "480f43472d1fcfdd7f23ca4e7266a5dcee7e6d3efc3f85356c2898fda094b3e96a54cab28200cb4958d920ae705932a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767399, "uuid": "00bcd8b4-0b81-42a6-a576-d012868d4d6b", "value": "T1A9933238E07384EAC91CD6B805D32FB833B26F559A5587DF0B54E1DC3B2637A8D21A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767399, "uuid": "de8af05d-8d26-43cc-bd32-eb9deb550fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767399, "uuid": "2fc393bf-42ed-462c-ba97-92e5e02cf7b2", "value": "768:1SKncH7WavCd2ULDwUzc8Ugmq3oP/oD75x1Yte1FmIOfTf9fgflfFf5fjfRfTf0c:1SxNQr/UO8/ofCtHI/DqSVFvTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767399, "uuid": "9780b1f6-50a3-4122-bfad-20cb217f6966", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767399, "uuid": "d9d181cd-e4c5-4da0-a652-2253a2b00532", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767399, "uuid": "1a863a48-b13e-4877-afdf-047accb4d573", "value": "164651e3f142e4aec14ea0716a217064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ca3532-fb75-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628776688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776688, "uuid": "b320e3ae-1fdc-4819-94db-7aa08e19b154", "comment": "Malware payload (CoinMiner)", "value": "7588f826a75b1d50ca6532ce171e8ec4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776688, "uuid": "9151f091-75fe-4344-b3d7-9b3025a4e4c5", "comment": "Malware payload (CoinMiner)", "value": "c039fdb9f60978c016661f8bc5de265e44d75d7ecc76ba768380d7a673d0cd2d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776688, "uuid": "f5c91657-1f33-4052-82c1-76972b9629e6", "comment": "Malware payload (CoinMiner)", "value": "9b62047974fe27be60dc7a02ddbebffc914e4d2b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776688, "uuid": "5d5835f5-ed42-4da7-8043-2584c855eb10", "comment": "Malware payload (CoinMiner)", "value": "25a2b34fc8c81f028ad27d2608625b25606b3876aadaf33b5ae8f2afa24e8e6698077dc01d4f1411df28389b30faed8d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776688, "uuid": "1d664dfd-58e2-4d6b-b042-63b93fedeef6", "value": "T1F7649D30BB90C035F5B612F845BAA378AA2D3E70973451CF52E52AEE16346E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776688, "uuid": "10b4130a-fbd6-41bf-b901-f60b294b7ab3", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776688, "uuid": "4e6ae7b5-420d-4f31-bb16-7840f8ff4c65", "value": "6144:RRPbpxKr9wFg3P6gcP1eFIhVXPQUT/4JeE+BHhC3AT:nbpUKFg/6x1eFIjP5nE+BhC3AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776688, "uuid": "58cb4ce0-3bc4-4ea0-a9db-3186d3fc031d", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776688, "uuid": "2f76f501-431c-4b23-a267-964c43006d22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776688, "uuid": "0fad8253-8a65-422f-8f29-2a28cd9e65d9", "value": "7588f826a75b1d50ca6532ce171e8ec4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f06f51d-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628749086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749086, "uuid": "c9583e40-6e9d-49c9-ab30-0e0963f67330", "comment": "Malware payload", "value": "e2d69f3e9539ebfa03a48264132cdd8d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749086, "uuid": "cc991382-f982-4328-ae16-3e549dd2edcd", "comment": "Malware payload", "value": "c0de9558521c3e67a43b17994f39bec3d80634d7c76d14deac0cc0e97456286a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749086, "uuid": "473a4058-ca2d-43aa-9925-7868cca399ad", "comment": "Malware payload", "value": "62c3b63cba049bfa4800a34cc7eef28522f2a1ae", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749086, "uuid": "ba69b616-3360-49f0-9208-cb0d4cb43e6a", "comment": "Malware payload", "value": "e25ca5df8816cd525dd254e9b49ff4ac5a38433ae7d58e1d0dd7bb3d3d3e6e12c1836aba8ced20f4ba2e81c87c5de49a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749086, "uuid": "7a8198f6-ebda-4584-9781-ee6b81535fc4", "value": "T18A547D0672D74A36E8DE07336F8B93628BB6EC348062C5174295770E2DF1585F367AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749086, "uuid": "4c61dfed-f21f-471c-a250-ef6f4e80c906", "value": "6144:iUmiv+sWTqp4nwELY5Ax3DiSJRz/tDDxtHhGGG766/i:iUFvETqp4nbLY5A99o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749086, "uuid": "d6c62b5f-c907-4355-b4a4-20b3eb7f3520", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749086, "uuid": "e0a069f7-087b-4d84-9296-98285ada035e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749086, "uuid": "189b1d9d-8d93-4695-8fba-84d4e68f701c", "value": "_---Atendimento-bojp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2f6515-fb2f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628746562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746562, "uuid": "8f1c36fe-2f47-4bfa-b8a0-73e86a0751f1", "comment": "Malware payload (RedLineStealer)", "value": "c4ff50648c4fb9e60e0f0c30a41bba2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746562, "uuid": "9e4b6d55-9cfc-4aef-a4ed-122a3ea33233", "comment": "Malware payload (RedLineStealer)", "value": "c15ff185f489812fa7ae3fe20c668f9611da7a2a3e54367adf0c28bf456d0720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746562, "uuid": "301a9c03-aaf5-4ebe-9081-f57c93759cfb", "comment": "Malware payload (RedLineStealer)", "value": "074731d50321f109427d2eb4ce0b6ee5e47e9d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746562, "uuid": "3f757f92-715f-4bb1-90c7-709e5ed5a0d3", "comment": "Malware payload (RedLineStealer)", "value": "b87291365f0db9a2965f109de13a4e62fb6b182cde7fd5faecf35cd05a7d4c517340b30b620779c32a358e32720144d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746562, "uuid": "c109c829-6b3f-4a7f-9ce3-0013b7118c06", "value": "T1FC14CF113680DC72F02178729896CFD5666EFD60DE20C5437B99375E2F352E0A73A3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746562, "uuid": "804ee6fe-9580-4dc2-9e30-a294f81f52d7", "value": "742e6f89721f9cdb5e5779dfcb30ce2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746562, "uuid": "f04ad9a0-7369-4c07-a8ab-900421976ba3", "value": "3072:sWqwnocYm8+nr5k14mME5ugrReX6moNLjTwa/N/zxJWtk0K:IoohUr5XgrRgfoLjTwa/RxJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628746562, "uuid": "322ccf09-05f2-45e0-8b0e-f2d351e4851c", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628746562, "uuid": "eb3c3b69-da27-4ae5-9348-19d710eb17b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746562, "uuid": "0f7f3a11-1c75-4602-b9b9-56cd7c1416e6", "value": "C4FF50648C4FB9E60E0F0C30A41BBA2C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f217e9a6-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1628776096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776096, "uuid": "88a790ac-258b-455d-969c-0a7f186187c9", "comment": "Malware payload (Socelars)", "value": "7cd3e96a1e9d811124f8b445e1565446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776096, "uuid": "bfe0f300-8bff-407c-90f9-4ac88da919a3", "comment": "Malware payload (Socelars)", "value": "c29bf093ac97b40ae3b83a7a4d0a5e5d5c00057c85da867760804bcc04aa377d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776096, "uuid": "0d243e0e-4b17-4345-b43c-1057febdd697", "comment": "Malware payload (Socelars)", "value": "0a97d946a451b4c1e5a10b7abd884bf315a5cc44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776096, "uuid": "969d6fba-6431-423c-a3f7-8172962d78a1", "comment": "Malware payload (Socelars)", "value": "3679118e014a3217f9a605cb17c376f2c3fea0f6e554d6e51c64adc7c80f7b4ca424455d30687c09951423d54bce1b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776096, "uuid": "70790857-7771-47c0-bd11-3a7093b832f2", "value": "T19E659F21F6429036FCE301B686FE467F8D2CB631131494D7E3C419699E619E27A3BB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776096, "uuid": "94af74c8-1d19-4590-878c-531abf54a3af", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776096, "uuid": "fa00d7c2-0a29-4ee9-9c09-c8a269dc3f50", "value": "24576:ZIVFA1pqtg/TnMbX0lwyh0FVmEByA1swFYyOsdwsuQOSIt21QtYfr0IP:MFA1pvTMbOwa0TmUqMYEOFQOSIsQtYDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776096, "uuid": "ebd6b330-0401-4590-b4d5-3b9265eddd54", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776096, "uuid": "3418c0a6-244f-4339-9ef4-d33cbd9aaf5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776096, "uuid": "0f2870b9-d239-40ed-90bd-2a778da06a49", "value": "7cd3e96a1e9d811124f8b445e1565446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c082379-fb6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628773724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773724, "uuid": "27991db2-5614-4292-94f3-7ab759113cfc", "comment": "Malware payload (Formbook)", "value": "7f420aecf233cd29f38ab8ba4e5527ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773724, "uuid": "8edc155c-df9c-402c-b4ac-2b3c4fef645e", "comment": "Malware payload (Formbook)", "value": "c35dc511756121de1ea79ead44b8d25157d6356bc5a59c2ff530a60b2c444bec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773724, "uuid": "3398405a-a1e2-45ec-b496-e15349ae6d06", "comment": "Malware payload (Formbook)", "value": "e1e0668e4b0fe9fdd0cb14b4cb67c237979aa13c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773724, "uuid": "6349b036-7aee-491d-aa11-1eeb5badc356", "comment": "Malware payload (Formbook)", "value": "60dd03d0b1c0b021f7ae2a27a7007acdb4f6991faa44b3af2ea35652c161bc913529d11f5efe527c0e23581a7d081400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773724, "uuid": "d68a9cb7-e7cf-48e0-a2aa-4fd386ad836e", "value": "T1D165A33C29B92627D075D374CBE5D82BB450DCAF3159ED96A4C6B3260372B5239C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773724, "uuid": "f86e2143-5aa0-4a67-896a-49c7ec2675cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773724, "uuid": "7be3c6f9-59f1-4f0e-af26-7e94135559c7", "value": "24576:ETcZ8sPcy+5GoPw9AYWespHUKGZT2fXs:kAp9AYWeUURT2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628773724, "uuid": "3bc5d2bd-f0d5-4a05-bf48-94d5ecd7cab3", "value": 1454080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628773724, "uuid": "31bee3f5-6bd0-4eca-b91a-e8487ca70b56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773724, "uuid": "27a7ba40-d118-4b3e-8589-f89686a306f4", "value": "pYjFvaWdzzw2WUg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0f4709-fb48-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628757401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757401, "uuid": "3f255d5f-f20a-465a-80ab-91e233c0549f", "comment": "Malware payload (AgentTesla)", "value": "bb6e3f99be7215c2afe4de4e80805ddb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757401, "uuid": "16063f17-04a8-46f2-8f95-c1faa3efe8e6", "comment": "Malware payload (AgentTesla)", "value": "c38e74eaaa19fef449a03e7852599a05c831fb844813e9b0b32d7f1f73fd1fac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757401, "uuid": "c5b22366-af15-4cc4-a20e-5b1d04b4d7e8", "comment": "Malware payload (AgentTesla)", "value": "5409cd1c457f429457ef0600d737517bc6b2889d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628757401, "uuid": "861f521c-97c6-48d5-b312-b59fb03f0598", "comment": "Malware payload (AgentTesla)", "value": "65ad91d3f1b1dc56f88a379846c8ab84ec2e2e232c2baf572719267f2da607a4a34e3fa4c1b9146edb2bd7cd11a412d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757401, "uuid": "8df42874-f454-4bd7-83c6-08fcdc8a5390", "value": "T1C2C40353A53D91F2CF69A37E54424EC801B11D48299DF64B139CB83EDA7E2628E1FD2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757401, "uuid": "913e84d5-9162-4182-aec4-c1063e9b686b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757401, "uuid": "1bf34bf2-b142-4dbc-888b-8f1844fc23d8", "value": "12288:FB6UYWgdwcqM44a5W8vHfb4JyEOc5lBT/D:FBHzcqfJfbzVc5lV/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628757401, "uuid": "e91fe81c-b818-48b8-b1e0-2e0375d0e9f5", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628757401, "uuid": "d0510263-df1e-4ac0-80a5-0bc6150b79b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628757401, "uuid": "f1512763-7a6c-4891-b81f-299980f3816f", "value": "bb6e3f99be7215c2afe4de4e80805ddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e8a813-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1628755277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755277, "uuid": "58290e84-3aee-4319-b25c-cf10842d7d3a", "comment": "Malware payload (Hydra)", "value": "cea98484826ce63b72d6efce2f692273", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "hydrabot", "colour": "#26910D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755277, "uuid": "b3d57de2-ac46-45cb-ad14-e4eed40856ad", "comment": "Malware payload (Hydra)", "value": "c404340baa0e1322364c75898e7ffefcabb660bab01979c22ebd98a502bb2310", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "hydrabot", "colour": "#26910D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755277, "uuid": "64baa05b-6f9a-42db-8e61-079d4bb32228", "comment": "Malware payload (Hydra)", "value": "0630dfd3cd0bce10bbe3fd232592bba63a97c59b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "hydrabot", "colour": "#26910D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755277, "uuid": "8cefd267-cbee-4544-8e2a-e7a561545880", "comment": "Malware payload (Hydra)", "value": "abaf18e0e77d9902691c783914100369e9fcf92546f00362767615a5d4a718a387a00a877de3770beda13a1c4bbe6703", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "hydrabot", "colour": "#26910D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755277, "uuid": "ec6ae2c8-491f-4f72-980b-acf742383f8a", "value": "T1D8E533E662AAC951F64EBD72408445CED10677ED21117E0F4E017E383E78E9F8B27C9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755277, "uuid": "907ecfb8-47ea-44aa-8ac8-818ffcd51a19", "value": "49152:6nn2yqlmunxjxIkdREbREIr7kN7TRcBWJ0D4MTzWdW/SQJbDB4y6+Xn565O4b4Y5:6n3LkNZdFJhRcQJWqW/pJbvXkbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755277, "uuid": "d4c68679-8045-4c94-9b12-50e4cf353ea3", "value": 3115783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755277, "uuid": "f6d0b100-6ceb-4b20-82cb-a5e9d512c07c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755277, "uuid": "3c14b908-6d52-4854-8801-b3934092aa18", "value": "95802_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126d44ad-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628749951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749951, "uuid": "fc551dc3-3f65-4cc0-bded-6d5b692d1e8c", "comment": "Malware payload (AZORult)", "value": "d4c7576ec36d8ed8da8385f11181f4c6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749951, "uuid": "69788efc-f5fd-4bd1-97ea-28579f8ae4af", "comment": "Malware payload (AZORult)", "value": "c43f6a8baf0ad84ca756e83e47f6b47fb6cd99290d64492ee714caf04b40bfee", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749951, "uuid": "9230dfb5-7384-4674-8064-e54f884b0235", "comment": "Malware payload (AZORult)", "value": "e6893e2b038cc15aba28e28f1ab482ffa576be9b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749951, "uuid": "dfe81495-c13f-48f6-a6df-f9cd26e3415d", "comment": "Malware payload (AZORult)", "value": "1a89f1bc2898f0c457e60354912fdca100944821b1190bf5b3569dab7f4019196ec5300187a06150c79d62c3c68de9d4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749951, "uuid": "c21d2edb-ba7e-4d3b-afb1-bb89bbee0aaa", "value": "T101F3E007B861F533C0A234B88874D730756EE869D7A585173BA8736E5F322C07A792CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749951, "uuid": "5f0ff2ec-ec17-463c-8d24-08228e972b52", "value": "6ccd4b375b5fd6882077c59ee465ab9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749951, "uuid": "1a9903f8-f342-4a2f-9543-2cf81502740b", "value": "3072:c45ftw60k65MOcsWkLLSsMyJ6ooYzsAdTmCCk+dj:ZUcsWkLesb63BGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749951, "uuid": "2207c262-d0c4-4b23-ad4b-c278e7e3e671", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749951, "uuid": "4b1b57b1-c60f-451c-a1ff-aa4fac104d6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749951, "uuid": "cd03578f-42d7-40e9-9e44-6e8e3068fbbc", "value": "C43F6A8BAF0AD84CA756E83E47F6B47FB6CD99290D644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2bdcbe-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628750529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750529, "uuid": "840916cf-8d5e-4ac5-a688-4e83d51360a0", "comment": "Malware payload (Loki)", "value": "73258aa0171e762efa0567481df6d2db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750529, "uuid": "4b533104-dfe4-4769-9a8c-ee367aa67061", "comment": "Malware payload (Loki)", "value": "c448169380e81c58f9468dfc7ffe85622b8e01d1b1b9cb66dabb7be265cd5306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750529, "uuid": "ad1abe4e-7a04-4b3a-a0a9-6196ec4bde6a", "comment": "Malware payload (Loki)", "value": "4f09e9f0c82a85c474f39e67b6e7f8cf9a399cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750529, "uuid": "f3fef06b-4249-422a-8016-2071f349d42c", "comment": "Malware payload (Loki)", "value": "80b3f5f2848c190f7b538818d7adbebe990c4fdc59acb02ed2c629d3d79ab3e809f5fccb9acd8dc892b7f71845aeb006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750529, "uuid": "8fe1a83a-080c-4a24-a58a-3c313efea52d", "value": "T1D7653A3D19B92637C069C6758AE18817F0449CAF31D1A9BC94D27F26C3F6A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750529, "uuid": "054156d9-5586-4726-b852-da024eaaa69c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750529, "uuid": "52620de4-c6a4-42b7-bff7-4755e79357a4", "value": "12288:EVeC5d9qk6jHghIt2oqKB5Puwiq0ua1yixAxg0y4Q6H+Uy1Susr8MmH3jC:o7q/jAhO2oqKB5PuhuWyixAsZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750529, "uuid": "fc714cf1-4846-45c6-a36c-05b0cd2f3537", "value": 1486848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750529, "uuid": "d78d3b22-506c-4304-a2a7-f3030fba0a27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750529, "uuid": "b8b2084a-30dd-405d-883c-953664e2e9bc", "value": "340002751NIAHOB1087830,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e2c5a7-fb68-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628771188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771188, "uuid": "235adb60-db47-41eb-96a6-2c7da2dfa354", "comment": "Malware payload (Loki)", "value": "65efe22a52a417f6f7e97e914ea69077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771188, "uuid": "4570a7e5-dd4e-4e19-8170-64cb87b827f0", "comment": "Malware payload (Loki)", "value": "c509b66c0755a4e9e7b7ad209f460f7765b6c06954c9c4f88f051c14cdbc1f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771188, "uuid": "053f1c21-6230-46ec-a3fc-d6db0c58a8fd", "comment": "Malware payload (Loki)", "value": "bae96aeecfb9007dfede71c0dcf2612f35003ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771188, "uuid": "73233ec4-360a-421d-bceb-91b06451c1cd", "comment": "Malware payload (Loki)", "value": "75f5400477249cd450510c4c153d2f8bdea620aebe38c51be81fcd241e8445593e80f515be32050d62bbb7f30e6862b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771188, "uuid": "659d0540-b84a-4738-809e-06290ce294a8", "value": "T11E4412217BE1E4ABE17051B21AAA9711CEBB8F2C15347343BB443B567CB3292E60D587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771188, "uuid": "a7361b36-a5f2-4465-86a7-b6d182b16f4a", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771188, "uuid": "c4e8496e-2ca0-4528-81b6-fa36d8af74c0", "value": "6144:Za4Tl5dq5S36e4sLOWM3I7e6/j1nB95E2cHcMrAL:I4R5I5gL4cM3YHL37DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771188, "uuid": "ad8e1ae0-b8c4-4da4-a677-4ad9e7cb6496", "value": 254261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771188, "uuid": "89155e6c-bec8-437a-b63f-1839c583f411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771188, "uuid": "df7b4e69-5e7e-416a-92bf-5571dd56eb7b", "value": "C509B66C0755A4E9E7B7AD209F460F7765B6C06954C9C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7448176-fb4d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628759703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759703, "uuid": "c7119c3a-8ebd-4d8f-8b40-2dec44790cdc", "comment": "Malware payload", "value": "bb9be41706b08a95da1c5c122e857ac0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759703, "uuid": "9a5ad105-77c3-4112-a34f-f14b55f0f256", "comment": "Malware payload", "value": "c5bce6cf4bf914611aacd42e92a84dc43eed7f8dee61e9523dd57d1340c7cfc5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759703, "uuid": "78978408-ca2e-4684-b732-01d1f12d4fce", "comment": "Malware payload", "value": "41740e9b1ab240fdd9982f96a1439920c06c1627", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759703, "uuid": "0e805bd6-dff8-4cb6-9203-267e375272ce", "comment": "Malware payload", "value": "46c03023b876e5fa78092780547ee1b450d1f439fcffe24585f30be4352454ef8802d9196257d94e834dc252b2699327", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "auth-services.club", "colour": "#554462", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "low", "colour": "#F3EF7E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759703, "uuid": "36276a08-f7a0-4894-853c-638876b1350a", "value": "T1F2562385F3CAAC1FCC77883287B68B6A57464D07C686E7174665B22C5C7B9C01F8AEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759703, "uuid": "6d7127b8-d4a2-440e-bc60-8fe0baf0bc06", "value": "98304:6W4wuNJb1SckEUP3p7zWDQ5g4s3V18ajehjLFiov56rMd9Q3iVC72AXtRsADnYyi:6BJbUcap7zWDTF1XjIf5aML2qE2ctRs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628759703, "uuid": "b57ff4b9-7234-4d8c-a4bf-35c4c22d627b", "value": 5963572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628759703, "uuid": "a76dbd63-9970-4ab1-81d0-4db837c6e312", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759703, "uuid": "28e6d9ab-8830-4fa6-a162-1a941c61a500", "value": "41740e9b1ab240fdd9982f96a1439920c06c1627.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca3de72-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628776436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776436, "uuid": "5a194421-cab4-4f25-9d47-9466ead01bf4", "comment": "Malware payload (Formbook)", "value": "4d19ccec518e703176a676ab920421fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776436, "uuid": "ce41e1fc-3ef8-428f-bf96-97649f7fd739", "comment": "Malware payload (Formbook)", "value": "c75eff07a3519dee7ab981166c1b6ff851d1e826e3ef5f0e36250b5983e3095c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776436, "uuid": "23e2547e-0057-448f-9779-b500eb65629b", "comment": "Malware payload (Formbook)", "value": "882e1ba33292285d86d7d99b3e9d9a59755ad9d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776436, "uuid": "144cca71-633d-470b-a2e4-ff183ff64bef", "comment": "Malware payload (Formbook)", "value": "c2ff757f91d83fd881b873f663d1204548c97520fef6029c435b726a252cc7b38c815025461a06113047037c0f309f7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776436, "uuid": "4163e2ab-762f-45bf-b4e4-e8bea7a1d023", "value": "T138259F36B6E17437C2571D3DBC4B97A9A826B9942F2C24466BFC1E0C9F3D2813939346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776436, "uuid": "a8f02c30-1c75-4d49-8d3e-9c059f647c80", "value": "39334fad6fc37ecf56243de5802e190c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776436, "uuid": "1c2707c9-b0e4-4f8a-bd44-24bd6c569855", "value": "12288:lq1zaytHkdB6KK/2v7YNZIeT76kASvukn/rML9zpteqDaGuI9:lqVayP/2TYNhaliD4eqDaGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776436, "uuid": "2d5a37ba-4d64-4f78-843c-5bc618eeaf56", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776436, "uuid": "16966fa6-7624-4b3b-befd-687afc14378e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776436, "uuid": "0797450b-ecbe-4bd8-bbe2-a658cff7f65a", "value": "4d19ccec518e703176a676ab920421fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5463bb74-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767671, "uuid": "68846280-c682-456a-8a73-c00d747f0318", "comment": "Malware payload (Nitro)", "value": "d126b33d48f9e5da43cc648a8ca7f392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767671, "uuid": "09404fbf-5df4-470b-ba13-ef12b697c99e", "comment": "Malware payload (Nitro)", "value": "c7dbba0767778f294d28e364de2a833d10e2b6b0a0b8477b10a5efe6436d349e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767671, "uuid": "5871bee8-16ae-4baf-927d-81384581e5b5", "comment": "Malware payload (Nitro)", "value": "9755ca804a0fc3c1ebd05b8c5c53936c5f3aa915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767671, "uuid": "eedcf933-9b7b-47e4-aa2f-9061cd79000d", "comment": "Malware payload (Nitro)", "value": "a8687e5667ebf51b10d6463c90033f907714ea66a0e3cb6a44faa886bfe9197c9dbbbe99d5b22b12c7492e55d37f1db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767671, "uuid": "abc793ca-566d-4f74-97ee-92cc4f939e3f", "value": "T1F75353286273892EC86C81B851FB2FBC1BB0AF165460C79D4A78D26C3E677B7CD10756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767671, "uuid": "ae03d2ee-7490-4b5b-934a-a75e7a9db716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767671, "uuid": "ba2eb51e-ddaa-404f-8b88-8a22713c80e2", "value": "768:NHc/dFw/P9UMW4IE3t8CVLDwUzc80gmq3oP/oDS:NQdFwPxIEC0r/0O8/oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767671, "uuid": "734cad62-b864-467a-9c98-79abff6f3062", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767671, "uuid": "b8b78ebc-6046-4fad-ae7a-97d8b24e5a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767671, "uuid": "3d94c13f-f878-49bc-b243-3173659c4863", "value": "d126b33d48f9e5da43cc648a8ca7f392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71509c8a-fb36-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628749681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749681, "uuid": "7aca2e58-782d-417e-9794-8f2df61bdad9", "comment": "Malware payload (SnakeKeylogger)", "value": "455924afa33112b4c94ab614a278347a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749681, "uuid": "01644578-1077-4e98-828a-4c61690d9476", "comment": "Malware payload (SnakeKeylogger)", "value": "c8ec3993f019e1eb809a9087b55a63fca50e09670c5e7747f499af35869fdd7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749681, "uuid": "3a7247ec-8c2b-47b4-850b-a831f89be4d4", "comment": "Malware payload (SnakeKeylogger)", "value": "01ed05d1016a9c9e5725f37f3470cb314df442c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749681, "uuid": "dc2d21ad-e252-4420-82fc-039960a10adb", "comment": "Malware payload (SnakeKeylogger)", "value": "561d70213e3663189b85f697c5176bc194a3172b5eb06a7be064771f1065f52b51c9f10f97932126607591ae42306c68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749681, "uuid": "a54fb4cd-f390-458e-8249-893564e901a1", "value": "T12C65C43C29B9266FC076C675CBE59827F400ACAF3152AD55A4C73366433AA5379C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749681, "uuid": "52cd3f09-c369-4f77-9a48-8ddd178253b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749681, "uuid": "fb79bd3b-582c-4561-b431-21df6a409254", "value": "12288:/w9XgcivlSgPutqjCnrPMwylOSwdfIhTCEKqDJbVNiYBWT2fXQzDowpNX5tBsvUu:otOvF9Il5eAEdiYBWT2fX2vOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749681, "uuid": "91cd53ed-1263-4e98-b454-fa10955637a8", "value": 1465856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749681, "uuid": "75fc5c1f-7499-4981-9417-8ada26f6a815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749681, "uuid": "af694feb-87a3-41df-ad18-284500d746b0", "value": "455924afa33112b4c94ab614a278347a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab28f04a-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628750207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750207, "uuid": "021c225a-b29e-4fc6-8b23-73a3a86586e8", "comment": "Malware payload", "value": "58bcdd6f6048e83acf269515fcc8adf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750207, "uuid": "d38ed965-15dd-4800-9c6a-99134d8ef021", "comment": "Malware payload", "value": "c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750207, "uuid": "209ad7e2-99fd-473b-95e6-5ffc7282a6c6", "comment": "Malware payload", "value": "d56f6916c809e7d8b18d1a5021bd07ec75324568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750207, "uuid": "58b51202-c5b4-4669-b69e-7f095e330181", "comment": "Malware payload", "value": "147097d9616bcf53e5f443a77baca0575b609acdd1706a3f3310fb16cbe79876488c277eb42aebca49867c8f366419de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750207, "uuid": "2f390b84-5ffb-43d4-b511-f8df7a4021d5", "value": "T1B9B4C030BA90C035E8B211F849B6A37CB9387A71973551CFA2D52AF906346E9EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750207, "uuid": "5b68733e-1050-4c42-bc14-f68e01009f8a", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750207, "uuid": "dd0fe885-3388-471f-b750-b63457ca99c6", "value": "12288:8S5eXQlyspXDxpZ4I+sr18jixUiW9u6o1QqtOE5:dkglyS/rWW6iW9u6utO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750207, "uuid": "92f295e1-c67e-404a-b32c-20c694653e1c", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750207, "uuid": "bdfbb1e2-c4ba-4324-b2a4-73d243ca9c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750207, "uuid": "0ce5c68f-5283-4007-bff0-ac90f5df5720", "value": "58bcdd6f6048e83acf269515fcc8adf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26aa6ab-fb34-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749012, "uuid": "b7249fbb-f855-4fd7-8674-c2a17767a314", "comment": "Malware payload (AgentTesla)", "value": "4a137beab46f691e4228f0fcbe9290a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749012, "uuid": "72c96600-c2f6-4175-a097-49671f250002", "comment": "Malware payload (AgentTesla)", "value": "c9cec3069cd9d21bf5ab0269b2b5ccc52d56e763cfe4c416906ab5b1c66782aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749012, "uuid": "f69dbfa0-b63c-4811-8e75-5e85b36487a4", "comment": "Malware payload (AgentTesla)", "value": "05ad309bb3ff5ca33e493bcccc018206e92f5813", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749012, "uuid": "64d99f98-1959-4120-81c6-fd8ffa834d6a", "comment": "Malware payload (AgentTesla)", "value": "464e79f5ae9a93108ea9fac65acbf6f1aee0e5c6dd2ef130a302aca89cda8f4b2bebd9fe04a0ba96b42885133f5d3d9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749012, "uuid": "2f889141-932f-49fb-87d3-b01e9a83a4d7", "value": "T1CFD423F162CD12EC78B8D85A6E3A3C3751F9AF7B5B0C868A056310959633CF2BC67644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749012, "uuid": "0138b4b5-9ec2-46c2-9058-52c7f8f4f179", "value": "12288:1rOwz79yXuDVtofYii9Nqz/4kIcgrKYbR5F64+jfySHsu9HENpWS:8wz79xotoo73grJt5UfySH9arWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749012, "uuid": "566f4ea0-b405-4a94-8957-b5f0d77ab875", "value": 630626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749012, "uuid": "cfa7e2b7-599b-4474-a87a-eba093a53a62", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749012, "uuid": "a76e0717-2c3d-414e-bc2c-236da6e4c1aa", "value": "SWIFT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a38af56-fb55-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628763064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763064, "uuid": "910c2dc7-a1d8-4a99-b8d3-a6c9874fa7f2", "comment": "Malware payload (AgentTesla)", "value": "421682363de8d20094fe311b7f8fda96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763064, "uuid": "265f80b3-20b5-488d-b1d5-4778aad27830", "comment": "Malware payload (AgentTesla)", "value": "ca23850ef172ad0dd4c6d9c9d186ced0b5aed3b00fbecbde935a13556746251e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763064, "uuid": "70722b0b-e7a4-431d-85dd-3fe6b3e6e4fc", "comment": "Malware payload (AgentTesla)", "value": "22b430f53a2b59c02319b28975e771700300f3ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763064, "uuid": "0e018b19-e3ee-4ea8-9dcb-a4e323c0c48e", "comment": "Malware payload (AgentTesla)", "value": "c6c8f468f445229568628fa39ba3fadbb0ea9fbb918b2ed85f613efb4693da1021e89c04254cf3b4fbab9267defe54a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763064, "uuid": "9d0f875d-78cd-453b-bce8-83244a3c3c9a", "value": "T1C5B40213A93C91F2CF29A33E40468DD815B16D18599DF54B13ACBA3ECABD5729C2F90C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763064, "uuid": "a802b0a0-f300-425e-934e-5907fedd14ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763064, "uuid": "c8b86986-cf7a-40db-b4e7-783248563020", "value": "6144:X5x4BCIZEvM+MMtCwCx9qceKgo86VDn+BlRRJ4zoOTgrvt7m:Jx4BCOR+MeCwCrJeKmeL+XrqVgZ7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628763064, "uuid": "d8fd257c-70d3-4630-8ce8-4d953e1dc3d4", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628763064, "uuid": "5db3e52d-494c-4652-ba90-02c5968583b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763064, "uuid": "ef75b549-b2e4-4411-8dd7-218fe334bacd", "value": "421682363de8d20094fe311b7f8fda96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847b96a3-fb1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737687, "uuid": "f46d48a0-b19c-4895-a725-dd260b156e26", "comment": "Malware payload (Mirai)", "value": "ddd8d68d8a73435fe46daf4117d3bf5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737687, "uuid": "9e27fcca-acfc-4323-866b-e0d8782f2e2b", "comment": "Malware payload (Mirai)", "value": "cb29d1de2690a04fada78ece49dcb547772c72fbfccd9b4661f2f598d6dd8a84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737687, "uuid": "081489e8-e273-46ed-8032-b5319749bd6a", "comment": "Malware payload (Mirai)", "value": "c6099190d643fe93ef540a2cae13848f8a37cbc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737687, "uuid": "6f5a8506-54c5-4944-bb4f-6418dd7de4e8", "comment": "Malware payload (Mirai)", "value": "ecf562a2478b73fdf8aea39ebfe02ba16c8c1b30385abf959d8ef0f559be070e5b7c77013456cd8053216e2f07880617", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737687, "uuid": "5f4f6515-fd0e-4a61-969a-0e9ec1bd0b3b", "value": "T1B3638EB9E1795E54D35105787D108938C723F00AA6DA2EF2DE86868FF99BEE8F004771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737687, "uuid": "97c05cbe-b76d-4b2c-97aa-804287f589c1", "value": "1536:B/9tdVPQwaEwt+9f66gFN1pSDTZAvj3fs3kSbw7DizQsCs3:BltnPtbVd661DTZArf+tC2zQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737687, "uuid": "be4fc4ca-d373-4f9c-b542-884bb04e881d", "value": 71836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737687, "uuid": "fb7eff8c-3ed7-42ad-803f-829649a98efc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737687, "uuid": "1a2e81cf-191d-455e-9f0b-f61bf104a60f", "value": "ddd8d68d8a73435fe46daf4117d3bf5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c634287f-fb0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733073, "uuid": "30d401e7-a980-477c-b973-f67e80a6203d", "comment": "Malware payload (Mirai)", "value": "02508e17d16394d2149790406b329541", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733073, "uuid": "25cb5320-c600-4e28-acd7-2ac7767f7851", "comment": "Malware payload (Mirai)", "value": "cb35ce45c9ae087b1779acb6668de03ef1f3374f713a15eb5f18f70aeba334dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733073, "uuid": "69657b9d-6f79-4e19-a852-d841ea302cf8", "comment": "Malware payload (Mirai)", "value": "d733206caa84a06479970875d6ad918811b85aac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733073, "uuid": "4846d3f3-1ae8-47d3-a9fa-c704d07dab30", "comment": "Malware payload (Mirai)", "value": "7f4a6414218dfb5618d0b88448a7ca90f29fe860f6eb840a946920478cd4400d310aa187c008287c91c8c12dcdce4c58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733073, "uuid": "305dc3c8-c451-46be-8475-7b0934b1fd60", "value": "T116432996BC928A06C5C46377FB1E518C332563DCE1EF33039E252F6076CA92E4E67156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733073, "uuid": "a3d82f48-8c26-470b-8231-55eeecb64e7b", "value": "768:6DND0QQaGP3lhtSvbrI6/Q1yf9ZV/AcHPI9reUAkt/u2Nq5T9mlBNOtdD4tLdfJA:YD0SGNh0Y680T/AcvSr+gq5lS1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733073, "uuid": "31d65d58-90e0-4e51-bc5b-6d5eb11a70b3", "value": 55700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733073, "uuid": "ab650393-17f3-4e8d-b94f-304641a66e02", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733073, "uuid": "23a1271a-db02-4727-89ac-e1914485ffbc", "value": "02508e17d16394d2149790406b329541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462fdf0e-fb5a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1628765070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765070, "uuid": "fbedb998-b2e5-4933-b95e-34f8e8ab5267", "comment": "Malware payload (Glupteba)", "value": "3c4808fcc3b035972f114ec4532e5f8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765070, "uuid": "1a8fdede-782c-4639-b1c2-5404a392fb05", "comment": "Malware payload (Glupteba)", "value": "cb7fc22f3b5ccf76238049bd7388f760204728fe846742fbda3560b1085efa7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765070, "uuid": "1d9e91e9-6732-4bf0-8c80-1851dea3e2b7", "comment": "Malware payload (Glupteba)", "value": "aeb6624a72b571d75028dca6f1f2e501994cebd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765070, "uuid": "175c1a42-760a-4e22-b00c-ab3bfea4df21", "comment": "Malware payload (Glupteba)", "value": "723d622c833fc3d47979973d35a13b2a3bf460f54bb84209cf87d91e318fc401df9b602877cf8937b181771f3026ed1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765070, "uuid": "fd1ade60-d930-4e60-bc0e-a82d1b6ca18b", "value": "T1BB263331AA60D878D8FB52FC41F627BD55293FA0DB6040DB45E806FE5B283E19D3178A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765070, "uuid": "78aa6b81-a2e1-4b5b-9270-9f9dfa75e2e7", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765070, "uuid": "5c9ed18f-cd9d-48e2-b896-b836fb5128fa", "value": "98304:argRwGt7eme6jWyULYgwHUUVYhW1djzfoXMMFe8D/cqqom3IaGwifndW:aMRN7B+yzVU9hW1eMM0e/BPdaGZPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628765070, "uuid": "71e08467-ece2-4bfa-9c2e-7c9e2bf17801", "value": 4707368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628765070, "uuid": "e0d40622-9113-46bc-9662-7b227c7c7037", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765070, "uuid": "f2750029-0587-440b-bb34-b062023683eb", "value": "3c4808fcc3b035972f114ec4532e5f8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a9bf65-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628776235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776235, "uuid": "fa56b291-d411-4501-b19e-c224f059d2c9", "comment": "Malware payload (RedLineStealer)", "value": "40606d2f4fbc0bfd653571f6d6687c0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776235, "uuid": "b8220eb1-f0ae-4a03-ab7b-440037bfc86f", "comment": "Malware payload (RedLineStealer)", "value": "cc2bef9329a741ecf4c4b92d6af68a78a7de8165b4876d598998abc6dd1a7903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776235, "uuid": "649f26bc-3655-4971-a133-73f5686598e0", "comment": "Malware payload (RedLineStealer)", "value": "60ded32798edecf1be3a9f3bbf52c30954267da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776235, "uuid": "bb67af8e-c7e3-4510-affa-811c866c3675", "comment": "Malware payload (RedLineStealer)", "value": "1e1c3f407a40f7627e8697a58b61f53d5b8be16431cba505c6cff9a564dbac788b1b68e95b65a778f820fe95801904d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776235, "uuid": "34930f2e-b64c-4774-acd2-23430d021cb7", "value": "T1BE84BF30BB90C435E4B711F849BA93BC692C7EA0973450CF92E52AEE56346E5EC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776235, "uuid": "d179d240-5551-4ce6-ab24-bc622ba67d7f", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776235, "uuid": "91f9c5fb-8898-45f8-a3f3-dd7d0ecbb434", "value": "6144:viFwBxMvZV6sie3Ko/v3JfI0DIWcKIuS/CwdNxwhNJHZiP7aRw9r5w:ewBmXNiIZnJfI01cHzx4V4P7e6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776235, "uuid": "d5def375-6eb6-4966-ac18-48354b7dfc76", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776235, "uuid": "e5f5cbdd-8f82-4cb4-b33b-cedb8890d6c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776235, "uuid": "5788ab69-ec25-40e7-9d0f-244a6a75a169", "value": "40606d2f4fbc0bfd653571f6d6687c0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e905e50-fb95-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628790505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790505, "uuid": "32486bef-99b7-413e-a9c8-2a6c197f0951", "comment": "Malware payload (Smoke Loader)", "value": "61cb66b049958cb48db0f5b33f96ae4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790505, "uuid": "3422e223-fbed-4d1a-b103-8a81059d67a3", "comment": "Malware payload (Smoke Loader)", "value": "cc700e4575649a012895b044f54ba9b8e87ea47efdeb755f32f135317451610d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790505, "uuid": "9940c9f2-7757-41b6-b976-4d5f2aaa25c8", "comment": "Malware payload (Smoke Loader)", "value": "ab128a4c170927bc46f28977ac26f1d1264bd6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790505, "uuid": "2a2d3932-e3ff-45fd-9d57-283a3ee72eb7", "comment": "Malware payload (Smoke Loader)", "value": "3a99790ad1d83131701fb4d51cb7fe642834f72e53d732cb568f3da5eb327f240ee2b699e1386ad0479a1b1ace597544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790505, "uuid": "8ce86f84-65a1-48c8-8806-46bae5a49b4c", "value": "T19F649E30BB90C035F5B712F859AAA378B52D7A605B3490CF52E41AFE06346E4ED3179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790505, "uuid": "89769d3c-14c1-4b98-b604-cdf2c00a6b45", "value": "62f5ddafa2c16d26eaa8112b2787e21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790505, "uuid": "da2cb905-9fb6-46c4-860f-4b49d524e970", "value": "6144:+WzzZx8rNATsl8QsIPh0YOlMw2pawoT5tl3xWRbZnxS/WB2:FzZeqTsl82PhLo3nDl3onxyWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628790505, "uuid": "bf123258-9f07-42f9-85ea-619869df0381", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628790505, "uuid": "56911f3e-8902-4335-9fe6-9cea991cb0d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790505, "uuid": "f4f49f59-77d1-475a-97e4-a9b39f556caf", "value": "61cb66b049958cb48db0f5b33f96ae4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ab8c48-fb19-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737395, "uuid": "0dbb8984-39e5-4a73-9619-a65eeae7b2f8", "comment": "Malware payload (Mirai)", "value": "b10a7f0ba61bb574a4aea9a0fc000a83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737395, "uuid": "623bbf6c-35db-4ba9-ad95-40130a96035e", "comment": "Malware payload (Mirai)", "value": "cca1ac60a1f61c01e0c2e05d0e7fabf151d015b9d9f876fcbcb6eeb4638e6d19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737395, "uuid": "2ac9ca21-f6d7-4d6c-9083-c3baccbe7f79", "comment": "Malware payload (Mirai)", "value": "17dc764f5a73c7e9873b76a1f5dd83dffcda781e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737395, "uuid": "06aa5f01-e70a-4d29-9d2c-b5641cce44ac", "comment": "Malware payload (Mirai)", "value": "aaa829af7829f2bfc70cdce8601b0912e88ad61300c2ba03a5004b7d4a76b02f050435dfe25211fbcf077116fdb09482", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737395, "uuid": "d5d419d2-ffe6-4984-a4ab-6f8ede60825c", "value": "T175833A38A9382A62C8D4F47A31FBC755F2F5321D2874998E7C610E6DFF2479059862F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737395, "uuid": "ef44ce32-8a84-4a16-a05a-9b8ecab4f355", "value": "1536:5r4qOaveSv2efCG9slObESDaJyKP55zw6vvR7GoFDqzsFt:5eav/1x9sobrD2ywzJvZZF2zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737395, "uuid": "1e7df9d0-5961-473b-b214-3d4fa47622a5", "value": 83536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737395, "uuid": "d12f336f-21c4-4bfe-a102-d490dc823924", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737395, "uuid": "f688d3e1-5566-43d8-8d71-6ef874f735ac", "value": "b10a7f0ba61bb574a4aea9a0fc000a83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fb05b8-fb28-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628743807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743807, "uuid": "1917a616-8266-450d-8026-23d6d6627c19", "comment": "Malware payload (Loki)", "value": "5d9d045489e48f1dab516376fe9d5a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743807, "uuid": "596f9218-a8d6-40a6-a37d-0a4b07de8a3e", "comment": "Malware payload (Loki)", "value": "ccc928a1ecdb56f04e2bb3890cc6ae8662464f9b4e641cefef9e18c059d66b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743807, "uuid": "46e1a3d6-9dbf-4edc-8d9e-4fcaccfe1b05", "comment": "Malware payload (Loki)", "value": "202c80d9984865b50dbd4b94e82f23967cc99ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743807, "uuid": "df3ab43a-4744-4eec-9eb6-aec5442aa35b", "comment": "Malware payload (Loki)", "value": "a7c493ab8357de7e3cddf067038e0968f68cb321e1149fe9a4b70dd11d1c92bf0e7c7cc84d49d98769dba6c400282d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743807, "uuid": "eff75b7b-0d50-4db8-b41b-437306f7b970", "value": "T1EBF4CFAD729072DFD417C976CEA42C64EA6174B7831BD247906701ADCE4E98BCF206F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743807, "uuid": "8db27433-1fad-4ead-97e0-afabd2d68865", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743807, "uuid": "8b57c010-7979-4430-bef7-fcb5f7a34ca9", "value": "12288:nnS4ESg/HK7z0oLYWW4xXcoPCZQTRbdbJCyH8/DKaxiTkGf52ki4pWIYycYIUx3L:0S34yzxMudVCyHSDrakGf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743807, "uuid": "ff52b217-9ade-42ef-9b09-c0406be7a507", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743807, "uuid": "0fc810e9-2f4b-400a-95c4-fc97f7ca382a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743807, "uuid": "f38be826-7bcc-447b-ac06-b65c35718dc9", "value": "INV#202170607#SGNBM4809600#BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741ed6f1-fb42-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628754839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754839, "uuid": "fa5e2488-80f6-4428-bc96-3fca94c4b6b5", "comment": "Malware payload (AgentTesla)", "value": "c47c23a7e481f2d428ed26ad7c8196f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754839, "uuid": "7c3252a3-3377-49f1-ad93-4a5acef29317", "comment": "Malware payload (AgentTesla)", "value": "cd97febc084e1f3eaa8c16cc0ff8d5ef8d5d8790205cb8a724a028e56dda4222", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754839, "uuid": "638e95db-e82d-4b8b-bbb5-bbe8a8bced3b", "comment": "Malware payload (AgentTesla)", "value": "51b32d7f0ef87e5e8693824245fb6ab856fa5fb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754839, "uuid": "7770ff05-2d6e-42f7-8a26-3637cac551d6", "comment": "Malware payload (AgentTesla)", "value": "eef2fec75059f7731d547b04a87a456a4248e9ee2b4b8dfdc53711c7a9f7a29a4fa1644a2412a7f07480a6307e2e9c4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754839, "uuid": "8aa968b1-70d8-412e-a994-0772e7a0c0a6", "value": "T1E365D43C29B92627D07AD375CBE59827F4509CAF3161BD94A4CA73260376B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754839, "uuid": "ed26553e-1bad-4349-8181-e3b67779b83d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754839, "uuid": "7019578f-2ccd-4dd4-870d-f8281d73bfcc", "value": "12288:mRrLj/v84yuQQN7stAPEWBoVL7DzLOYtA1XcHK/kBKT2fXok/HmUVpGF9EVxib:mRr3vrN7WADBoFnxt5HbBKT2fXovOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628754839, "uuid": "4361a512-b4ed-4ea1-9038-b8f93fc6a7d3", "value": 1438720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628754839, "uuid": "dbace98b-86f5-4542-9491-32f673f49d49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754839, "uuid": "71086b32-64ec-4536-b36b-1775e390ff60", "value": "Swift Transfer Copy mt103_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea50338-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ZLoader)", "timestamp": 1628776090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776090, "uuid": "6c70e357-d61d-4722-9417-c3675da30a39", "comment": "Malware payload (ZLoader)", "value": "a9dd9b9eff47af724436e2abdcd5ce6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776090, "uuid": "52da8b23-4a90-4eeb-8344-e5db7376c9b0", "comment": "Malware payload (ZLoader)", "value": "cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776090, "uuid": "5c56f851-5a98-497e-80d4-09bbddcf4539", "comment": "Malware payload (ZLoader)", "value": "1a9c9258f0345f5edddd933a7bd15ec42be51f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776090, "uuid": "70bf5ad7-2d99-4774-8aaa-7f5165a5bd53", "comment": "Malware payload (ZLoader)", "value": "05eb3c328dea6d374133f85a0078c72c31521f42732db75ef6150307bc7eb9ebcfca6a73c402dbb95e5f66d102f89503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776090, "uuid": "792aa77f-b12d-4a83-a24c-d2a95d813c1d", "value": "T1FDB4B051CDCD1A30F2AE123E848B53F69A3E6D51AB18B577D64CBEBDD1F4180E812B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776090, "uuid": "37e059c6-709f-41c6-9934-09948bd46c50", "value": "271c576c8fc6bd157aead4bf8676c94a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776090, "uuid": "2a8d180a-5c99-4a4a-8e05-60f77cad62a2", "value": "12288:oSOtDj2zB3iGZDhWVw/D0//EwImW70sct029xey5ZgA:qD6F3RYg0T/cy5Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776090, "uuid": "101956cb-c27c-40ae-9408-f56a20ed0ae9", "value": 497328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776090, "uuid": "3f68c443-9904-4758-8575-b56366d48fa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776090, "uuid": "fdc6b6e1-1588-426a-b64a-10aff813622b", "value": "a9dd9b9eff47af724436e2abdcd5ce6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c59ed8-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628750385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750385, "uuid": "2db97b81-7f06-4299-b507-a583df07172a", "comment": "Malware payload (Formbook)", "value": "1bd2c04eca08ef48cfe2b9860d5d12a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750385, "uuid": "e0d9ccde-e63b-4952-97d9-0432be42357f", "comment": "Malware payload (Formbook)", "value": "cde3eddb48864869869b8a59c81843b8e4fc1243170ff598ec92e28a5d7c8b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750385, "uuid": "828c29a3-8599-4fc7-a7fd-833309a2f0f7", "comment": "Malware payload (Formbook)", "value": "dffd6174716cce65fb113c228a30adfcebe6f57f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750385, "uuid": "62d34b52-e1f6-4df4-b312-78846502bc6b", "comment": "Malware payload (Formbook)", "value": "88d4cd7fe2a1ba48b0d357c785a0fb628d2e109c8d0300526f9ef56a6f681736bad733213d2d58da0a25de25e59f7c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750385, "uuid": "ba2a9260-4357-4d52-a83e-cd377d835125", "value": "T12B05BEAD3690B1EFD827C972CEA41C60EAA1B4B7471BC207901705AD9E0E997CF156F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750385, "uuid": "1d7ac82b-575b-4ff6-b31f-2fa73eb4906b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750385, "uuid": "809f56bd-4e89-4816-b6d0-079380ff92b9", "value": "12288:A3JR/HK7zVNr2NSo4X7lJwmcFhKlQbWDUwiFTIqpVFeGOh80kh4ypuL6yqd6ZesL:YqZNKNiXnwz0lQbWDmlVFYhxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750385, "uuid": "85f3ea19-bf06-4a64-b183-de829f4e68ba", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750385, "uuid": "e6ca8304-5b90-4bfa-9818-c9bae1154155", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750385, "uuid": "6600e172-7e32-4eda-93ba-3d75c30bf28b", "value": "1bd2c04eca08ef48cfe2b9860d5d12a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecc209e-fb93-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628789539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789539, "uuid": "5b6f35a5-c934-4d6a-a3b8-bb73be934935", "comment": "Malware payload", "value": "3d8d4cac22c958088035cc6c76d7202f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789539, "uuid": "5c9d9a26-56f5-4acd-a026-e3c3fd189f3c", "comment": "Malware payload", "value": "ce258f0738c07dd72640acce0e20d3601102cf20e4bc8000d93b0231800902a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789539, "uuid": "0731e5a0-ad61-491f-89a4-21ef73227057", "comment": "Malware payload", "value": "f4b7746a636c361c7f2ac0351df5e3b73dcbbb7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789539, "uuid": "1d5ed7be-cb22-4116-b8c4-92849481cd0a", "comment": "Malware payload", "value": "63433a585ab8463b1183a1b9c83eff6575d2bbd0070e4a547d9a8630428233b57c2ece45255a44318ee1ec806a4c39ae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789539, "uuid": "6f572932-7ea0-4493-b17b-55c105b8e2e2", "value": "T1B3B1C802536162845A921FE6EA1F70E0E56B9872BDD4B9CBB940B73DBC85F56E780C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789539, "uuid": "739d459c-de0b-43db-ba7f-7c72c81aa003", "value": "96:h91oGIj8oF4WEhFrKiYDNVHOmASISaFOc7OL66QDuhdtAeywJOZEgKzJ:B6weZVcSISaFOcBpDuhdtFOZEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628789539, "uuid": "27f5e04f-8343-4085-be08-81df46297c85", "value": 5549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628789539, "uuid": "34bf4421-a2fa-4853-a89b-2ddba946787a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789539, "uuid": "5e2e82c6-7f4c-4ae6-9348-a7acb8b1c56d", "value": "ce258f0738c07dd72640acce0e20d3601102cf20e4bc8000d93b0231800902a3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b518df4-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767549, "uuid": "2d855587-bc6d-4db1-9b0c-aa034790a7a0", "comment": "Malware payload (Nitro)", "value": "bd6a28824f6d3bec6c3955b47b8e37f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767549, "uuid": "d50f50ce-c220-42a4-96fc-7e2eb5f8b5b6", "comment": "Malware payload (Nitro)", "value": "ce35a705ef3459ab9189cbe0439f776a64fc6be992da0e61e77ff238c669af32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767549, "uuid": "ef0e6582-c159-41c8-891b-82ce138023ad", "comment": "Malware payload (Nitro)", "value": "9e48389bfab6d77710cf8a2f7dec27467357278b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767549, "uuid": "81547ad0-fcb8-41cf-a3bb-a2eea94ad778", "comment": "Malware payload (Nitro)", "value": "a8fc32f997c05dd1ff5104e0b85f83d9520a440e9eebe9fbfd0f509bc0b5d96b8c5ad5f3a7cf696c1512879986942796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767549, "uuid": "e79873a6-3936-4c94-91bd-bbd554fda75f", "value": "T13153532852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767549, "uuid": "8a364447-ad19-4190-ad39-a701103bcaa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767549, "uuid": "62629b4e-5f30-43a7-8777-e8419575baa0", "value": "768:rASVqCXHV2bScj+mDhWEQwNIoHlYLDwUzc80gmq3oP/oDY:rASMSc95Qw5ar/0O8/o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767549, "uuid": "2dd2e66c-c1b6-465f-81c0-5f795345a611", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767549, "uuid": "4d3b135a-3281-4ec8-b879-4e97e783abc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767549, "uuid": "8e40ac08-e42e-4ef7-a660-95d96856fe9b", "value": "bd6a28824f6d3bec6c3955b47b8e37f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cacda4-fb80-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628781629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781629, "uuid": "190cc8e8-00b2-4295-a647-7b4efe2b27e3", "comment": "Malware payload (SnakeKeylogger)", "value": "d5f2b6db6463048232e0aba9880cd649", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781629, "uuid": "4e4820c5-cab5-42f6-af94-b7ffd46f83ce", "comment": "Malware payload (SnakeKeylogger)", "value": "cee16f97554960178a201aad26469926cd079a4254c0f3c420b01b59589f0712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781629, "uuid": "61a82d08-d381-4498-becf-e9e0fb536f63", "comment": "Malware payload (SnakeKeylogger)", "value": "87bfa2ca736a11a60c79fa74481447715ca57920", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781629, "uuid": "71c531c8-4e0f-4494-97c5-f171fc6313fb", "comment": "Malware payload (SnakeKeylogger)", "value": "f13f233a577b95dfbeb00defd17e1eb36f44c512eae46bd3e3ed4c422322700881b864bcf65a34482ac43a8bce00ab53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781629, "uuid": "f650f1ae-1ce7-4fcc-814a-649c52ebec19", "value": "T1B554D021179C8BE5E67E7B789A851A0077F9D367E3A6C52CBD4E01CC0916A3283D1737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781629, "uuid": "472c17ce-990a-4e9e-a7f6-a11a09711105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781629, "uuid": "f047fcee-546e-47a5-a1b2-3c97de6dd233", "value": "3072:JCVQiibkIczSKQUnNw6KiGhGPETM5tklaY5akt6FB0TvqHCM6FrW4l248V3FMrFd:JfiibDbOPCMHtyABrHCfFCVdKrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628781629, "uuid": "a3453a2d-cbce-46e4-9676-5fdb94d85249", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628781629, "uuid": "afdf402c-e039-43a4-8275-e1b721b91891", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781629, "uuid": "e6cd5a0b-7d93-45e9-8509-a39b757e0d9d", "value": "d5f2b6db6463048232e0aba9880cd649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb71890-fb65-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1628770046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770046, "uuid": "ee049eb7-5d03-4dc6-ac2d-9cadb7a2b82b", "comment": "Malware payload (Glupteba)", "value": "e8fdef43d7bfe3d19a167bf5552ddbfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770046, "uuid": "e329ae70-6daa-4d31-a695-09c86a233627", "comment": "Malware payload (Glupteba)", "value": "cf46c5f2cd03626cad846f9d3d55366a7b469704eae8ed7ba54eda6940dc9bba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770046, "uuid": "a7a434d8-21de-4b76-99b1-eef3aca6bdc1", "comment": "Malware payload (Glupteba)", "value": "e0b564a1ad203118100964dce71def9c5acd1d76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628770046, "uuid": "646ccc4e-694a-41d9-9ccb-c125ef8c3bb8", "comment": "Malware payload (Glupteba)", "value": "ec74773c03d890fe67d9fc860dc5d83ce18fc428f1cf433f75b1e7f682572abde0cd87dc576a254bc164d2bc85695049", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770046, "uuid": "122579ad-2495-46ea-a101-7877f1b8db71", "value": "T1812633217A408039E2BB16F8417983BD963C7D759B3850CF43C617FA5A38AF4ED72296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770046, "uuid": "186aa6fd-1be3-478c-8e9a-79beab46ba66", "value": "62f5ddafa2c16d26eaa8112b2787e21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770046, "uuid": "4efbf19e-cdcd-4072-b065-23c975b6893c", "value": "98304:ZTRMZbA792GLVSICcysmeMgpOh/Dvx8TwLesUI/Wjn1:ZlMZb0NgLyMgA8eRc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628770046, "uuid": "836bde5f-791d-433b-b629-7fceb70f7a40", "value": 4706856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628770046, "uuid": "97911491-1971-474d-822b-b74d6380026a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628770046, "uuid": "ba41b945-036d-4205-9fe0-003a14164445", "value": "e8fdef43d7bfe3d19a167bf5552ddbfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec70e07-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738026, "uuid": "b0cb47a5-74c1-40dc-b36b-8d8d5fadc2ac", "comment": "Malware payload (Mirai)", "value": "dd0aca50643572d27c1905dde751d3af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738026, "uuid": "2923a8ac-62d6-40b8-ac22-98ea0964fcf1", "comment": "Malware payload (Mirai)", "value": "cfef225b3bf4a0c4b7f15f5ddd3b1e559921e9270e060a987771ab81ddc30587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738026, "uuid": "c47845a3-a931-4243-be0f-e594d7a8873e", "comment": "Malware payload (Mirai)", "value": "0840aec00824507bf2481ff5ce19d8cf13ca3983", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738026, "uuid": "ed67ccc6-09dc-41fa-a86d-94d7c5b1652d", "comment": "Malware payload (Mirai)", "value": "2b47afbf457365b152581d89ff9de80959e96d0a649408604345cc124e00770cd682cf9b7b56d85df2ed7f426ff54d0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738026, "uuid": "24f8b2f1-9764-483b-9f65-a2c0f2bb14a4", "value": "T178B33A0798615F73C045ADB529BB5530072BBA120F4F1F9AB57CAAB4074F8DEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738026, "uuid": "3d7cf584-3b0e-4997-b836-1b2e3244b723", "value": "3072:moNToIWzKoFIon14g5hLwDecr68LkY0Px9gQNfR:TNUz2Ej4g5hLwDecrfLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738026, "uuid": "f01ad990-65c2-4c64-96b1-447a529d308b", "value": 108419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738026, "uuid": "7e7d6567-d123-4fd0-a64e-0667baf5a071", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738026, "uuid": "a17ecbff-3f75-49d3-b8b9-0f2d43db403a", "value": "dd0aca50643572d27c1905dde751d3af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817192ba-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767317, "uuid": "aabda113-9d23-410c-8438-c868e9156f8d", "comment": "Malware payload (Nitro)", "value": "8762a2d33a5ebda0d6f4ad092791d0ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767317, "uuid": "59e5391e-5c3b-4368-95ce-4742c0d9e73c", "comment": "Malware payload (Nitro)", "value": "d035e86bc527b1bbe1aecee656db2263a0fc130c34a402ef501740c6ad257f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767317, "uuid": "a57931ac-550e-45a3-954e-ba3a08496961", "comment": "Malware payload (Nitro)", "value": "c91b18dc9e5531d218910309d6be05b2a30760ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767317, "uuid": "eb38ab1e-6dea-4d7b-a7a2-69866308e270", "comment": "Malware payload (Nitro)", "value": "47f5ee000ad962864c8d46622d88bc9091882d129c90bd5743bf660af8eb2cf0eba94ea645b4c8d83f3bf32f2ccd3725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767317, "uuid": "2ded5b1e-9228-4fc8-960e-181552b00af8", "value": "T18A5365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767317, "uuid": "b5f8ace8-d1ba-4f50-bfa9-644ee7c16d9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767317, "uuid": "58960d74-c225-4d60-b156-fd8a2d2412e0", "value": "768:DOucKn7n1JGDNANIUCHvLDwUzc80gmq3oP/oD/:DO2GDNAPyr/0O8/oL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767317, "uuid": "75749879-a075-4254-a755-adf9f826eb25", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767317, "uuid": "7b107cf5-29de-4661-9f5f-61ddfb4a97ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767317, "uuid": "e20d9c85-f193-4ab1-ac03-7e1035286d31", "value": "8762a2d33a5ebda0d6f4ad092791d0ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbef9779-fb3b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628752007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628752007, "uuid": "00cd4aa7-dc66-4dff-b910-aba0409c6de3", "comment": "Malware payload", "value": "9e970f3f09f8888f971233dfdbc1c5de", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628752007, "uuid": "2a08f491-4c67-48b7-9299-f5553cad2711", "comment": "Malware payload", "value": "d13fac2df3590ec2f9dbb1e17d05e2b8803d655c5f5534aa385b413af16ecf51", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628752007, "uuid": "47b3d4e3-4935-4bf9-8b3e-212a32014d01", "comment": "Malware payload", "value": "51258e3df95677d6b9b7e884cfe9cdd4505383be", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628752007, "uuid": "f5d13d17-0729-481d-8f54-d70c9adf7e05", "comment": "Malware payload", "value": "1940dcf92c755721a6b90c793f9dcb0dd8991231d052f8f3f85d22801a894fd8014bcadda54834313bb3b9a84a714667", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628752007, "uuid": "f4a5278f-cda9-4cf5-9fad-13e1b83f3890", "value": "T15C82BF5E93062824C363D8BDD81A93D5F61E68760242BE893524A14C37E63EB57D72FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628752007, "uuid": "558bfabe-d6bd-4b70-a8e2-cb8ad2b8b3c8", "value": "384:60wBPJ2cNPrkQ/YFbYr+UiKd31QWoySmEXgp/ys0hBUj:cBPbPL6bY6KfQWB4o/ys0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628752007, "uuid": "079d99c5-d6dc-42aa-b41d-f970c5fffe99", "value": 18889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628752007, "uuid": "c81346cb-5974-437b-ad00-7283e7391782", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628752007, "uuid": "cd2547ad-2754-4306-847d-5defb940943f", "value": "Outstanding-invoices-June-2021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6368c3-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628756385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756385, "uuid": "468fe2b7-dc43-4234-8024-1f7b412c3f42", "comment": "Malware payload (Loki)", "value": "fdbcd536c1de437df31a440f35019c03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756385, "uuid": "0f340109-99e4-451c-b095-1adbef78a1c8", "comment": "Malware payload (Loki)", "value": "d24b8170ae01b68882734d975036a482dbf4f941af283ffb433fda5f0f820f49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756385, "uuid": "b13c0d92-5c27-4101-ab47-7d09ca12be23", "comment": "Malware payload (Loki)", "value": "6533c338307aa0acaf49a27d6baa011bb413b6b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756385, "uuid": "46df5dfa-8bee-4261-b12e-ad04fcff2fb3", "comment": "Malware payload (Loki)", "value": "34420522135945af928112afb456934a56ee7c900c045989e1ebf860419192418572177e6f435a3ab74ecca39bf82fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756385, "uuid": "58b95f7f-de8d-4c84-b619-e6f0f510d4ab", "value": "T11D55B43C29B9262BD176D375CBE59827F4409CAF3561BD94A4CA73260372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756385, "uuid": "675c4f9f-7cb5-43f7-a9ca-6071f4da6fa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756385, "uuid": "64e591da-2eb8-483d-8b66-aef832aea10e", "value": "12288:MKVntWmyUK5kRuwUrvhrbe+y2nv6LUC2xx8T2fX2k/HmUVppUuEVCHo:MKA5OKhvzyiPC+8T2fX2vOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756385, "uuid": "037e7f42-bccb-4793-8aaf-976dfee3073b", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756385, "uuid": "04930ffd-78b6-487d-9c6d-ef54dd32408d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756385, "uuid": "bc956f1f-2c80-4951-9dcf-065dda3d4474", "value": "fdbcd536c1de437df31a440f35019c03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac37710d-fb14-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628735177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628735177, "uuid": "0a136899-5af9-4e7f-be36-0e7b1f7eebac", "comment": "Malware payload (RedLineStealer)", "value": "5952874b718c58ca9c92e8153bbb1f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628735177, "uuid": "67d78937-eb54-45ae-b15d-e8bd96b2ea54", "comment": "Malware payload (RedLineStealer)", "value": "d269615dd97e39c3625988646ad11311cde5a6e4074a43181bd68229646ac0f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628735177, "uuid": "5b0dec2a-8849-445c-8b9b-789249117f29", "comment": "Malware payload (RedLineStealer)", "value": "10b7bb1fb72d76688ee69132bdb52112943a3d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628735177, "uuid": "549dd06d-969c-4a51-8600-8ec0787cb73c", "comment": "Malware payload (RedLineStealer)", "value": "360a2d56e9db4a5c253977760c11bfd26c9041ca2e4f66d5691059ae0ff7ca2bdd3c61e1c9f3545612d426dd7fccfbe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628735177, "uuid": "b715b389-4682-4c44-86d5-d52d82a35562", "value": "T147649E30AA90C035F4B616FC45B6A3BCA92C7EA1573450CF92E42AFE56346E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628735177, "uuid": "f0d2af21-e398-4c15-9877-708b239fe3e0", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628735177, "uuid": "6264526e-fb8f-47db-817d-1ab9344f492b", "value": "6144:fnUBS7x5PjmInG1hBTenQ0xj4KVjfzUZksjyNd1TZENk:YS7TXG1vqlV4sEZQTEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628735177, "uuid": "957e3ff8-1ffa-41c2-8c1b-27e44ceeaf78", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628735177, "uuid": "b6398a92-b854-43c7-8887-7895b05dd14f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628735177, "uuid": "356e9f00-f23f-42b5-9b56-dceb269762f3", "value": "5952874b718c58ca9c92e8153bbb1f89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacadc5d-fb0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733081, "uuid": "508cb3a3-e7ec-4aa7-b6c9-b81101e08723", "comment": "Malware payload (Mirai)", "value": "ef2cf9905593ff799b65cf8734f63abf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733081, "uuid": "8f76bdd1-7ac6-4086-9853-bf5d5b40f464", "comment": "Malware payload (Mirai)", "value": "d2824184653ce3f8c20e466265826ca7ec04b580f4732c64336f72cc8693a900", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733081, "uuid": "45461e93-4b89-4629-a5c5-aaacc11348ee", "comment": "Malware payload (Mirai)", "value": "47959f94b03982e0d2f421dd598093bd8ddb1682", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733081, "uuid": "29812647-123e-4c53-b58a-d2d777552aa8", "comment": "Malware payload (Mirai)", "value": "0a47cbb615753b641adeb1faecf5c3258d45dec33cfae3cf3fe6e04a7733e06c2b3b10d08f1ad31c91314191d23aebb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733081, "uuid": "2142b9d7-70b1-4a26-81cb-5429e63e82ef", "value": "T14B231896BCD18E59CAC42377FA2F419D3312A3D9C2EF3717CC141B1176CA91E4E62A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733081, "uuid": "5a4986e4-3c24-4144-a559-62017fd998b8", "value": "768:J/HwcdHiUe5xKsC3l8iXQYuAJ35DtcHPLlXepGkh+i2NeoCqgOBNTO1:FTPeasC/XOa35Dtcv5XHdeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733081, "uuid": "c9183080-f7c6-4507-951c-2ff6b59a3f93", "value": 46444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733081, "uuid": "424bf69f-94f5-4027-b433-41fe0bf5d9bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733081, "uuid": "c09ca707-c22d-418b-b8f1-7bfa43ee3ab3", "value": "ef2cf9905593ff799b65cf8734f63abf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb130b0d-fb08-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628730128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628730128, "uuid": "c2ea2385-7a2e-4380-9a8e-d69b8f8a1cc7", "comment": "Malware payload (Formbook)", "value": "52bf72d40f8ecc722a7d8d6ae83ad2d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628730128, "uuid": "da62c19b-55d6-40c3-a634-cf9dc8cb4b2b", "comment": "Malware payload (Formbook)", "value": "d2e29e115cef90f4158d21938c7458762bb01be720156a2f7c8bb8d021704fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628730128, "uuid": "f0b41491-829a-4457-ae8c-71709eab520f", "comment": "Malware payload (Formbook)", "value": "cb2013d03a2bf04448b20a5a4aec0a8f979c8d9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628730128, "uuid": "9c935b17-f255-4e32-8d20-48aae6fe8fed", "comment": "Malware payload (Formbook)", "value": "b7f6df81ff174f5c426e2438de5c500b2e11e7c57eeb504f55016b49673738cbd337c481537b8467b9a6afad3a0127d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628730128, "uuid": "fb9a81b9-3909-48b3-89ab-297771334ac4", "value": "T14B05C029B784B904F2770EF6CC9E50109AB9EC035A43DF2FA0E8F629687B759943315D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628730128, "uuid": "c1b84857-c5ae-4a71-9477-553b29296e5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628730128, "uuid": "519cd127-699c-47bb-bddc-f5212776a556", "value": "12288:x1kMHia17eHK7zvdqcFhPfmUxYXNUuki1qcbJdwd2/a:qcTdqMVfd2XNZLbJWES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628730128, "uuid": "2fe48303-1750-4426-a9ee-a0b95da08ad5", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628730128, "uuid": "e3a4f395-2483-40a4-9d27-c2a2f824a03c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628730128, "uuid": "9edf2260-7b82-41fd-93a9-4cf7adacecb6", "value": "Inquiry List 0001-081021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e63ada4-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628775741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775741, "uuid": "33e251f0-b512-4b40-88ad-788edeab57ea", "comment": "Malware payload (Smoke Loader)", "value": "207aab764ad08489f71f5c65d26b3736", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775741, "uuid": "abb5bf4c-2be5-4bc5-9086-2ae55dc728ca", "comment": "Malware payload (Smoke Loader)", "value": "d36b6f0b859b7a0491f3f2a994ef23e9975979a8c95ea46ca97d2daf8004cca2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775741, "uuid": "84b3f0f1-c5cc-4be0-9595-e7ebf0346da0", "comment": "Malware payload (Smoke Loader)", "value": "1e94fc6d424669ce9bda114163989e90927b0084", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628775741, "uuid": "b4cac7d3-1185-4c01-b7c2-959a5fff2c86", "comment": "Malware payload (Smoke Loader)", "value": "2eb82222625aaae002ae4b8cac91cce12f1c95871b593df94001d1181eb0292ce2b826b05d4ab24eb9885b8296ac6f16", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775741, "uuid": "bd069de8-3478-4a47-bd20-6acb0e237330", "value": "T1C6648D30BB90C035E5B602F889BA937CB92D7EA15B3450CF52E51AEE56346E4EC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775741, "uuid": "db1c063e-59ea-4ada-8ea4-c9afe6856935", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775741, "uuid": "8e5d4579-36a1-4038-8f8b-1ef4d33ffa3b", "value": "6144:VXabZxxr9wGo+cBvcZRl2wmchPfMFcLggGwuZFqiLXK9:wbZHKGoPBoRl2wxP0FygVfF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628775741, "uuid": "e3aa752b-72c7-4146-9a24-31a06550562c", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628775741, "uuid": "fef3dd6b-5ff5-41a5-8d12-861b74b76052", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628775741, "uuid": "02c0718d-5fd2-4926-a5fe-8cc6f9b12f8f", "value": "207aab764ad08489f71f5c65d26b3736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d29f9a8-fb95-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628790476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790476, "uuid": "b912be0e-4ed2-4203-bec4-484c15b2b237", "comment": "Malware payload", "value": "0ba0a113f62d686e5099d7487af69a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790476, "uuid": "2bed5d4e-c25f-446e-9419-f3ab5b628fa0", "comment": "Malware payload", "value": "d4022fb55323e92297a219fb50b8a4426db98e4f5466abb861bc6e526a10bd83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790476, "uuid": "484da25d-41ff-4bd4-8886-678db96035b1", "comment": "Malware payload", "value": "179c992b47840e63436d96148639020b90fb46c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790476, "uuid": "427deab4-d992-491f-b5af-5dd05ed66d4b", "comment": "Malware payload", "value": "dc35cd00b404a0cde2e05d742815b73265e20a7eb5119a935204f80df2da581710fc0fd5eae3f860ac03a057ebb2d849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790476, "uuid": "69b715f6-5de1-4d3a-96a7-69c5134694d3", "value": "T1D3F20930AB01D038E86A21F981AED77DE52C5772835831D7D7F59EF6A6285E42C318CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790476, "uuid": "a5583dfe-9715-4c35-8041-23a33dd2948e", "value": "768:p4FSgzdhmGq83j01EVOk9XYFrrmwOjhjGfu1LBZQQBy06HTAkvmxzC8dLl8MFm:p4Egzp7eFaNj7PxBy06zAMFMFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628790476, "uuid": "58c71be9-30e3-442b-a0a6-8ff3fe8229f5", "value": 36474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628790476, "uuid": "9ad02cf0-d161-4845-ba6a-a1bd84f00c25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790476, "uuid": "52b0965b-90c2-4b86-8453-1643c10888c9", "value": "0ba0a113f62d686e5099d7487af69a44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312b6778-fb89-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628785221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785221, "uuid": "944a7b94-ef4f-472c-a77d-0dbb7a7d5b37", "comment": "Malware payload", "value": "4ea94d0c2728936c5a436fc095675879", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785221, "uuid": "226ea8a9-fb93-4359-83ae-42941fc9edd6", "comment": "Malware payload", "value": "d52eb597d93380ec206a6714d7cac840b154395073305db959e0e2e7f51735fe", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785221, "uuid": "e3a354f2-cfb3-4f88-aa89-7c2fd4b63d36", "comment": "Malware payload", "value": "466147a1deba9b6ba3c047826fa57bc5500b9db3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628785221, "uuid": "615febb6-6ab9-43ad-9663-92172f905db6", "comment": "Malware payload", "value": "0a8b117b2b6d0bcfa91e33286e294bfdbdbce86a27cfd7f90a83ba864e69c8aae678c37bbfbfd50828d86311fcad9194", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785221, "uuid": "d140278f-80a8-4675-b85b-cb6b13511878", "value": "T1CAA50142F359EC27C133C17656791232605ACD189E4BFB872906B76C6DFFE988E85AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785221, "uuid": "b915c978-26eb-4ae0-beb2-70f4a8a82c41", "value": "49152:QL4w6Fgk3N8dYyEMlJsfeLlr0HJv0Mfa55OpLv4tmc4o:au4YnMlJuqlruvD8tMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628785221, "uuid": "53ee89a2-657b-4e47-9468-6545ac29c1c7", "value": 2111786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628785221, "uuid": "4b441ac5-bedc-4580-807f-057bae0d7e6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628785221, "uuid": "906b4020-ced2-42b5-9c36-7129f40f9887", "value": "new_song.mp3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60dd8a0b-fb10-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733332, "uuid": "d6da6db7-8077-4e90-a49c-4fd1924ec0b0", "comment": "Malware payload (Mirai)", "value": "54cbcb9048936cb6700484f2b7aaaa1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733332, "uuid": "1aa0c3de-51c8-4ab0-8b47-ff107c0ec31e", "comment": "Malware payload (Mirai)", "value": "d53ff37c3ede642d0782d86251513da157769caac063e0f737e27c2dce52cf99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733332, "uuid": "3d1a9df9-1c28-4979-a37e-7c213c49c864", "comment": "Malware payload (Mirai)", "value": "f82dccb18b3437abebc742fdac9b3bd07dbec349", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733332, "uuid": "2af803f7-9cda-4d3b-b298-117800659306", "comment": "Malware payload (Mirai)", "value": "7fda2b35f9506dba48627f8fa7d9ff45e5c0027752904ec253e27c8f6e88d5dfabea48a01c43180acf3c15cda08f036f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733332, "uuid": "a965873d-f94b-4093-828f-ecf77973cca4", "value": "T130334C41725C0E47E1671EF4663F1BD083AEEE9011E4F589274FFA4A8276EB34189E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733332, "uuid": "7433de07-a844-4c1e-8c60-3d6d05aef05d", "value": "768:Lg6V115cLOIkvf8WwPE27RA/eHDGVxucWlOLskFGz7UUa1mUIbZwsq1K:LpMOscyhOZYUZUUIlwsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733332, "uuid": "21696ab4-14b0-4b25-884d-38fb4ae93cd3", "value": 54732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733332, "uuid": "64907ea9-e50c-4903-93e2-6050bd72611f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733332, "uuid": "3d2441df-2665-4ada-8396-4a2c3e3b2864", "value": "54cbcb9048936cb6700484f2b7aaaa1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42027aa5-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628750460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750460, "uuid": "71bee06d-3f77-475d-99da-fa7b0fe98e57", "comment": "Malware payload (Loki)", "value": "d25fc181130e4435d0d1740211718606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750460, "uuid": "bce2623d-4311-4ff3-a9cd-3bd1d45ac799", "comment": "Malware payload (Loki)", "value": "d54aa1b12b9f0414be80ad07738eb0810a66651d7c21923d3b46787575f3954a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750460, "uuid": "33a244a5-e0f1-4862-b16f-fbaf1c700b41", "comment": "Malware payload (Loki)", "value": "b34d8d6ed6f5aa85692f52e759726280c3d88baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750460, "uuid": "fbe72053-b3e2-4deb-b0b5-c7243cb887ea", "comment": "Malware payload (Loki)", "value": "197297c212d7d300136868c0bbe93dac489f87de509999f5fd4ce2f1dca92f202adf8a51b72c0e1662f408fc9390d915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750460, "uuid": "4b55820a-18af-4faf-b2ae-090c275cd190", "value": "T192F4AFAD729072DFD817CA72CEA42C60EB65B4B7831BC207901701AD9E4E95BDF146F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750460, "uuid": "31fcdf92-5fe5-4179-9017-8e403613a630", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750460, "uuid": "73a08746-434d-42b9-a34e-c380109c14af", "value": "12288:g3/HK7zSfK6iWerYwFFDkNATAOkWOYtEMj+MuGgUbjOIoJ2IdyIv+k0JBW7U+:N95WerzFyA3kWMlDGFby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750460, "uuid": "efe28a52-096a-4ddc-ab94-4da695326747", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750460, "uuid": "dee43421-febd-43f9-9670-84153ce090ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750460, "uuid": "ae169dc6-145e-41b4-af50-327666be93f2", "value": "d25fc181130e4435d0d1740211718606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbad99d9-fb43-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1628755389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755389, "uuid": "dc98e0c8-1d2b-42ba-ace8-0d585f6b4358", "comment": "Malware payload (Glupteba)", "value": "e202cef5730322b10c419b0874ead1c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755389, "uuid": "fe1b188f-47d5-45ce-a278-da4db5348515", "comment": "Malware payload (Glupteba)", "value": "d6d3dd2923a9b46473abb1d811fb4b64bdcf2c0c15c1f48161353b1c220d7e23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755389, "uuid": "1cc0d6c4-1769-44d7-9b40-f680079358b9", "comment": "Malware payload (Glupteba)", "value": "11fdd11a78ec59e0b73427b7ca9e80ce6da45741", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755389, "uuid": "52354e75-bb86-4448-920a-2a916ceb0abf", "comment": "Malware payload (Glupteba)", "value": "a3b69ec1ac6bc2d26659b793c63cc74d955979da79f817d4c8501a7333eb2048f41810d3eef6645a70fcfb495d90cabd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755389, "uuid": "cc5e0d8a-5d2c-48f6-a5fc-e1651cf67b7d", "value": "T13C263320A7D0C431E4E716F848F6A2B8552CBFA0C75820CF96D679DE26246F26E317C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755389, "uuid": "7ea231d3-a605-4920-b82d-77b61d0de14c", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755389, "uuid": "6ed99c0e-a47b-47d5-b25f-30a947f9394d", "value": "98304:UvcNtBvoJc7I0r0fy0hqQRi69numaD09pJ6N5f1qlFBdWiBl5E1oz2tiut:UkJtjr0fXRi65rwfCFTZteoz2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755389, "uuid": "b13b9ccf-5f98-46f2-a493-b9c416b4df29", "value": 4714536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755389, "uuid": "92763132-ed0c-45da-8920-0b8bfc8e12d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755389, "uuid": "b70d1834-202e-447e-81fc-c2359d921bdd", "value": "e202cef5730322b10c419b0874ead1c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcd5e90-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628776253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776253, "uuid": "a5068e99-b42f-43e2-a063-eb73c16c1f0e", "comment": "Malware payload", "value": "c1dcdb247552f7b173bcd80fedb6f7d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776253, "uuid": "d3b753d4-743c-4d10-a59d-f3ac16bb531a", "comment": "Malware payload", "value": "d721b7140ab975a4153cddd5d1caf4cf7358815ce4a7ab85a0a5a2ed205b3a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776253, "uuid": "3717d059-890e-43e8-8d3f-0dd5fa9d6ca7", "comment": "Malware payload", "value": "5c4b381d88bda4830ab4d8e99db7a9193537a800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776253, "uuid": "7ffdbb02-43b8-44b1-979b-6d6bf3fd4c8c", "comment": "Malware payload", "value": "5a486bddfd98536e8f7726d579571c0c06c82dc0b135efaf389bacf8b1cc273a455ab22615f386a5d3e6a3033dd25ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776253, "uuid": "1e05c2c0-9a2d-452b-a25c-f275404ddc93", "value": "T14FF3D2E3B07CA45DC1140B74E021FE473D669EE4C9C1F635A141FBE6AA3A298CEE415E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776253, "uuid": "0514e2aa-37b9-49ce-b7e8-7cf88ee820ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776253, "uuid": "c5870387-61ca-4268-947a-f40fca19b266", "value": "3072:E43N+PM/PslPA51D8IlT2nIE+Lq3N8rFYet:EqNCxs1zl0IrLq3NEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776253, "uuid": "f9edf617-3280-48f9-86b9-377ba4ec62f3", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776253, "uuid": "7bba9c7e-5733-4fc0-bd9f-783318c1c373", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776253, "uuid": "fff6ecba-1dea-4360-915a-07e88a9237cc", "value": "c1dcdb247552f7b173bcd80fedb6f7d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab120ed2-fb32-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628748060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748060, "uuid": "47a95b57-43f8-4741-b712-dda0d8726e82", "comment": "Malware payload (RemcosRAT)", "value": "8017e41b2c71f66ee834d21728a4160b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748060, "uuid": "bc8ff8b6-0945-45b3-a931-2435e72dc5ab", "comment": "Malware payload (RemcosRAT)", "value": "d83290b80bf412884168a6d24a06fad12edb578cc612ea555476b422a4499613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748060, "uuid": "79c1f2ea-ab14-46ec-a702-dd9943075934", "comment": "Malware payload (RemcosRAT)", "value": "cb8019c2aa21d17daf49f1a9a23e13281b8f4ac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748060, "uuid": "ffda286c-659c-46bf-b8a2-a1233023ad0a", "comment": "Malware payload (RemcosRAT)", "value": "eb3621664899ce79563fd45ec20211922132ba85f55f6434f7e604f478d960d1046ceb0ba0e5630f1c5f7577de420caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748060, "uuid": "c108084f-59d4-4d71-bd57-b0ac801b08bf", "value": "T1932512567ADCBB20F4BD1B779961A25202FFDD401A23D86E3CE430A94E3BB9C4550B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748060, "uuid": "cf7facbb-6028-452f-a186-ccd02197d9d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748060, "uuid": "d6800c09-2587-4ba1-9d4c-cb7d3ee3d394", "value": "24576:J7oP3LsrNZqTcIPBz8xAOZmuaWdEIwjS/1aOaxys:loTYqAIPBz8xASvaWt4Q1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748060, "uuid": "e7b9942f-0d58-4934-996a-c236dffad151", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748060, "uuid": "f22d262c-00c3-4323-b914-32f35711e30d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748060, "uuid": "f2cb7f53-792f-48a7-bb0f-06621cf4e837", "value": "BR8909894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97311d67-fb37-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628750174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750174, "uuid": "f60ffe2d-be4d-4e75-9fa6-bcd7c43612ba", "comment": "Malware payload (Smoke Loader)", "value": "2b59125e1716bee461896dea76bfbeba", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750174, "uuid": "805ebb2a-8c77-4589-add8-0361acf5496f", "comment": "Malware payload (Smoke Loader)", "value": "d86ead8b78bedb30771260a9397e93bbeb0556007c95ba16c1482154ecae4ed5", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750174, "uuid": "a6cd9cf5-be86-4e80-a041-75fa1e7e3745", "comment": "Malware payload (Smoke Loader)", "value": "c878a1ee86aad2b561fc62cd9e9b7245979115ff", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750174, "uuid": "49726d20-ecb2-457e-ba10-1d274a86bf53", "comment": "Malware payload (Smoke Loader)", "value": "8636f31263c3cad547a8c2f5d57ce9456acd3cecd32951e2272a6ecf28c2e4fc565c61e9f87f3b080f30452d5739d23a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750174, "uuid": "b880c117-00eb-4fa8-8985-8d7e7811f5ca", "value": "T105649E30AB90C031F5B702F845BA937CA92D7AA1973450CF92D52AFE56346E4EC3179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750174, "uuid": "7817d4d7-3498-48ab-ab7f-99036f89819b", "value": "0b2673717edc4e64b07cfaab3e6cb412", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750174, "uuid": "2543648a-2071-4a68-a151-c1f3a46e6806", "value": "6144:VX/wgxbvZVK24rFg+v07XeVWRuucb1OHbvJqkxN5w:xwg5XK2uO17XeVGcqTsGNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750174, "uuid": "87831c6c-e0d5-4ac0-94b1-24f53c3dbff7", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750174, "uuid": "859e3e72-0c41-418a-9411-b1605d90e3e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750174, "uuid": "a670ac40-e444-451e-a4ea-693dba633477", "value": "2b59125e1716bee461896dea76bfbeba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd8100c-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767658, "uuid": "45df107e-08ed-482a-9d0f-8f7dd9c10c33", "comment": "Malware payload (Nitro)", "value": "d1aa446b12a3bc397210cc65f61f5109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767658, "uuid": "d388cf0c-026d-4759-b5f4-b6cbb2708d36", "comment": "Malware payload (Nitro)", "value": "d8ce4feeb4e2d3fa52d8d13f89eac8c6d31bdeca94adde4f21a61e29f25fc595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767658, "uuid": "2c5c6280-939f-4f41-a2eb-dcfdb6236379", "comment": "Malware payload (Nitro)", "value": "d0ea94f5e9849b50858d42837c5a97b32c417654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767658, "uuid": "46ccac16-c612-46c4-944c-f417d30a474a", "comment": "Malware payload (Nitro)", "value": "bb631698e94db8d15b619e576b3796a5f8d1a71b4ec662988188d03d049345d46e6715b2bbdc3f05386198f7e2ffa0c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767658, "uuid": "1e58b168-75f8-4e72-87a2-406d225e0bb2", "value": "T19F53642852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767658, "uuid": "6c391592-2e10-4658-bbe1-38b42cb0c767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767658, "uuid": "251eb5b7-9c0a-46fe-a8ff-6abdde19d822", "value": "768:oKsMqCXfVcWWSM9ZkiANIU+dnYLDwUzc80gmq3oP/oDp:oKse3M9ZkiAP+ir/0O8/o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767658, "uuid": "2929fa84-0817-4f7b-b4bc-ae402cc00e4a", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767658, "uuid": "61d831a6-02b6-432a-8592-a72680908d24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767658, "uuid": "0597b118-9e75-4ca6-af33-3ffdf66955c3", "value": "d1aa446b12a3bc397210cc65f61f5109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324fb094-fb0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628732825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628732825, "uuid": "f3fdc5de-d03e-4ba2-8b6b-72487068a8c7", "comment": "Malware payload (Mirai)", "value": "ea3fe79753f91e9beba897cdcc78b19c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628732825, "uuid": "3fe5020e-1e15-429a-a926-6f4de311a8cb", "comment": "Malware payload (Mirai)", "value": "d8e69ec947470d10fa8f30cbe1cc074da94eddbb2eb58d1962e67168d0f71da3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628732825, "uuid": "433f6778-ac98-4781-90b1-921f68a5a1b4", "comment": "Malware payload (Mirai)", "value": "3e028adaf170011479236da5e9a4d45144460585", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628732825, "uuid": "5cf3ef24-7cb8-4f4b-acc9-7032ecb1b175", "comment": "Malware payload (Mirai)", "value": "82608e196491b03318682729f7a9c65ffbf389d98b2545295f725ff337d8e406b9fe58e93ead0cb176c2d308e4b59c20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628732825, "uuid": "4646a01f-df98-4d44-b7fe-12a17f867a60", "value": "T179338E61C86CAD44D25C42B1BD288E785323EA09EA962FF54A4AC352D407FDCF52E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628732825, "uuid": "a8116398-5955-4cc0-9a91-c7d0666109f1", "value": "768:su/Zo4AqUq6CYXAA9CacyaxqCI35DXECEtCoQR3zo1MOjRHiC0D6Q1:x/ntUJCYB9CacLsZTE4bxE13HiC0D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628732825, "uuid": "97e6a1ec-06d4-46d1-ac63-a36c0c0ed08e", "value": 51108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628732825, "uuid": "f97a7e99-294b-4cb3-aea5-bdedff45ec7d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628732825, "uuid": "68b19854-7e41-4c13-8e77-21e14c1be897", "value": "ea3fe79753f91e9beba897cdcc78b19c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6b13c1-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767737, "uuid": "2cfd34c3-6184-4b49-a0c8-75d99b9f083e", "comment": "Malware payload (Nitro)", "value": "fd3569bdf323487fdc45516ef598a0ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767737, "uuid": "5c6ef83a-4d66-4373-812f-b8579054c759", "comment": "Malware payload (Nitro)", "value": "d8e9561612c6e06160d79abde41c7b66e4921a1c041ad5c2658d43050b4fd2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767737, "uuid": "98ffc439-7480-468b-8fd4-b577148b2a97", "comment": "Malware payload (Nitro)", "value": "b0155ee5cd923f4352d81e07f4e40146efbbfec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767737, "uuid": "cf9be6bd-ee10-42a8-bf04-f223c3d433ca", "comment": "Malware payload (Nitro)", "value": "e97be7ad9bb723d9470b85a8f38e918cfed66ee166e3449e3a97763295377bb02b4ee4effc1e1efa979ac74c3daabe54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767737, "uuid": "a776adb9-dce0-4b08-875e-7c7665ffc45b", "value": "T19A53632851738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767737, "uuid": "c717eafb-0e48-4ff1-a0f5-f0c81eb6f8c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767737, "uuid": "0dac55e1-c226-46ca-afb3-ffd13a9833f7", "value": "768:lnbdqCXAVwfAYYIuqQ1/A6IFi6PYLDwUzc80gmq3oP/oDhv:lnb5AYNfQ1/APi1r/0O8/olv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767737, "uuid": "f4e8c920-a555-4fa6-86f3-e7e0c9677ab1", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767737, "uuid": "4149edd4-076c-4a96-83f2-b7218608d6b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767737, "uuid": "af436ecc-0cfb-41b0-9177-f8b986d0ff1b", "value": "fd3569bdf323487fdc45516ef598a0ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8564be6-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767409, "uuid": "c471ea71-0aac-42d9-9f58-99589683af00", "comment": "Malware payload (Nitro)", "value": "612573b52e295ad8712af2a901d7f43c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767409, "uuid": "285ba752-c65c-4042-b4f5-29f71eeefc89", "comment": "Malware payload (Nitro)", "value": "d92f59c8bcd52ff02fd0f769cb91193b1af3fc101ef6b036337446a5174ee7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767409, "uuid": "8b74d956-5caf-4a3d-bb3f-47d02c09ceb5", "comment": "Malware payload (Nitro)", "value": "0a82efa1a4bd688bbb813018befd9312e962e455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767409, "uuid": "7ebb6ef6-b507-4cde-a089-2dfae2934868", "comment": "Malware payload (Nitro)", "value": "86a15750281b059748c5b806383bf1e5611847909aedffc1c5da3bfaa181da1f12d8424d33fc7fcff645e9d8860616dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767409, "uuid": "c64c7239-90eb-4fb5-9e1f-e2c87e8937bf", "value": "T1FB5354286273882EC56C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767409, "uuid": "720b1764-2696-44da-a5cc-5a0c6a422469", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767409, "uuid": "86406d65-72d8-41e5-8955-302d5060872a", "value": "768:NOucKn7n1JMDNANIUHvLDwUzc80gmq3oP/oDT:NO2MDNAPPr/0O8/oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767409, "uuid": "81b1cebc-445a-4fca-bede-9809f7c29d3f", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767409, "uuid": "dbfca764-3f80-423f-97c0-9e18017d0181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767409, "uuid": "45eeb74e-3e07-4ea9-b2cd-5fd06bca93bd", "value": "612573b52e295ad8712af2a901d7f43c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882e6a19-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628756591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756591, "uuid": "16753868-05f7-4e5a-b17b-87c40eee2b7a", "comment": "Malware payload", "value": "e0427aa05412f4f30ced49e5c3c180a8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756591, "uuid": "3a4475a8-d6a5-482a-9163-6f7f3a7c0fdd", "comment": "Malware payload", "value": "d9776af9bcfa9fc83bd763004ee716ab93adc73b8a49cce02fdcd3e6e07746f7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756591, "uuid": "650998d2-378f-48fe-8b47-950429bd6ee1", "comment": "Malware payload", "value": "4d5859088ea1368cfd7c5f2260c4313d8bbde691", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756591, "uuid": "bc11f754-332c-4094-802f-22b82a3e9ee2", "comment": "Malware payload", "value": "a3e8a561975433ac678f0c6d6d52084b949c7b0b0537b9e85aa9bf4f235d5681e331b0330c5e0c680ac6c0efbaa385ae", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756591, "uuid": "8e431d27-230c-459b-b0b6-7d6b0cd48bf4", "value": "T1DC44E1116E626F12D80455745BA6A7EA160CBD1FCBF2224F345CFA0F77339AA389F604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756591, "uuid": "b80b5484-f21d-4c13-9a5d-a1cb3c6e269d", "value": "6144:7Y2BStl0z1aTLN10tvgypkNx9ksveBi/Esje:8/n1TLNgI4kNxGsveWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756591, "uuid": "47befd6d-7807-48f9-b3dc-4b3dfb5fa248", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756591, "uuid": "3e6105e3-7936-406d-9476-185785ccee83", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756591, "uuid": "16dd98cf-0de1-4d7a-aa32-b07dad89497f", "value": "EVERWORLD OTDR.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbf456a-fb1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737652, "uuid": "75dbb02d-2b5f-40d0-b9c6-d5ce3847d696", "comment": "Malware payload (Mirai)", "value": "5d3b731c293c5a5fe415e3ed1bd0cd55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737652, "uuid": "f59df447-52d4-457c-a837-b7a6cba65d2a", "comment": "Malware payload (Mirai)", "value": "da0b507fd669e3cd81244135b261afb5d7f9775f0f1cd0b1bf93f5a32e40818d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737652, "uuid": "18a19490-97bb-4401-bb03-7efda71cc628", "comment": "Malware payload (Mirai)", "value": "c40330efc6a326b1b7e7fa907d67cb87ec6fc99d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737652, "uuid": "f1c59247-ef91-498c-a529-b259be1b650a", "comment": "Malware payload (Mirai)", "value": "7f95ab5100d1227eacdbfc839f9ffe00af38103f57df47e970429927f0477198e221573d376a5f30ad93395a1f87efe7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737652, "uuid": "b04c8d7b-2bc2-4075-ac61-8d757cbc4ec4", "value": "T125044A05DA809B17C6E23BBAF79B428E3323975467D733058928ABF43FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737652, "uuid": "36a0b912-64b1-44e8-a10b-84ef819a0bd7", "value": "3072:0V/Yb/dnp+eQPGp+37T/a+Brz/5TPibksbfh7H45hLaq3zVbYM/9cFommw3Bq/1A:d+v/a+BrzBTPAbfh85hLaq3z+M/9cFoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737652, "uuid": "a12b9804-6c88-4b3f-8377-80e535c11577", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737652, "uuid": "3cdf1f2f-2611-46fa-b080-c70982d9d413", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737652, "uuid": "2fabc31f-3237-4013-a12c-559d1afca735", "value": "5d3b731c293c5a5fe415e3ed1bd0cd55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6849bbfd-fb10-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733345, "uuid": "f06e7010-612b-4d9c-a344-5afc8344b83b", "comment": "Malware payload (Mirai)", "value": "e89e86b94bc736ab68baa0b390e2d574", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733345, "uuid": "30aff56e-6470-4d11-ba62-8857f874c006", "comment": "Malware payload (Mirai)", "value": "da51ba782e4ba0b77b677c1a9b0c3c94fe337399b66afc23afd2f80a4280000e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733345, "uuid": "10265620-fd18-4f46-b639-fda9815c9848", "comment": "Malware payload (Mirai)", "value": "e09d584976eaeb50dce5efe9a32f14f37ab0d11f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733345, "uuid": "6dc3d395-be51-4f3e-9e77-279dc5644585", "comment": "Malware payload (Mirai)", "value": "55de56d71b8e980dd2d25d245fdd9b2f1eaae1df087764eeb6f22816dfb4c3d2d003f8a065174de8d8cafa4770df8e0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733345, "uuid": "149687ce-071e-4780-bf9c-ccf2ae3a53ed", "value": "T109D34B46EA808B03C4D51776BA9F42493323DB54D3EB33069E18AFB43F86B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733345, "uuid": "3e7a57b1-f39d-4a30-9933-e23a350c750a", "value": "3072:7gUJ7h/x/4Zi7arc+eLO7/URCleaduz2RM/9bla/u5:7gUJ7h/W07ao+eLO7/RlluzkM/9wu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733345, "uuid": "349e7c67-7412-4142-a8e8-715cb9575502", "value": 130692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733345, "uuid": "bf42c9a9-d3ae-4f1d-bd39-b4d92112655a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733345, "uuid": "ec05bdca-1126-400b-b006-738c7f39012f", "value": "e89e86b94bc736ab68baa0b390e2d574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dd25df-fb41-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerber)", "timestamp": 1628754550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754550, "uuid": "a0e966b0-f8fc-4d06-9ae7-ee3eff7d0bd1", "comment": "Malware payload (Cerber)", "value": "99ff688d1a2b535bb025eaf91367d6d9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754550, "uuid": "473a7247-9cdd-4b89-8111-a2a6bacb3036", "comment": "Malware payload (Cerber)", "value": "da6ad6b01c00868cd5f7d60aecac9b9d3b651e83c8e71fbfe8e2922fedf84575", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754550, "uuid": "5a7bcb32-1203-4a08-93f3-66c558f3dbe1", "comment": "Malware payload (Cerber)", "value": "d3bd5fcca0285244d6c4d56f9e87c481fdc9a85c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628754550, "uuid": "99a37441-8006-4cc4-b5fc-3704a6f8c217", "comment": "Malware payload (Cerber)", "value": "5339c7dfc1000cb2adac5c7bf4842d8034190e738a8ff017709d01f121c5f134bf8e9808eac2c37b52151abb8c0612a1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754550, "uuid": "5b48310a-58be-4605-a1f7-8dc27caba1d4", "value": "T1E5E5332EE383D0AEF5135233D0C3B64F751556588ACA717F853A48A304B2AA6C31BF76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754550, "uuid": "1fffacfc-f6c7-444b-b7b0-9a034da700cd", "value": "49152:tzRvJXKb1k0kaBGISz9uw6QdGyuKYCHfJBA3JNa4n0XG0nqGKqa7Jhezy/tKo8:k+0LBGIQ9fbdbQAEZNH0XpnqG8k3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628754550, "uuid": "e98c2e62-044e-4d77-8dd8-28e996db4889", "value": 3106167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628754550, "uuid": "6fa6362b-d103-45ea-83f2-38ad4c83c318", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628754550, "uuid": "ce828c13-5c66-45eb-ad7e-396f559d07c5", "value": "H\u0131zland\u0131r.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96614b54-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749313, "uuid": "3743c3a2-b707-482d-b382-b0d883cd63f1", "comment": "Malware payload (AgentTesla)", "value": "86b08fa838ac41662bdac3982455fad4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749313, "uuid": "5bf58d4f-599c-4f30-80cd-93246a4bca85", "comment": "Malware payload (AgentTesla)", "value": "da80d0fb057f6b0312b05b0fe8bde289c506903b0d1f15bf915a98b30a982d70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749313, "uuid": "939ea572-f771-4499-8cd5-45feded632b2", "comment": "Malware payload (AgentTesla)", "value": "45d4a1dfab3a752171f7b4f632fc26268da3fb23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749313, "uuid": "f32bfcf7-0408-4822-ae02-5cf4a22f6466", "comment": "Malware payload (AgentTesla)", "value": "fd18507c7eafb737fb95dfd6408a39c078891f21c5047e345dff2f2e97b353a5350d0e2c9e5c51492fa02ee3f2835eab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749313, "uuid": "c2f167c5-ef02-4362-93a2-0dfa4a2da759", "value": "T1B555C43C29BA2627D17AC775CBE59827F4409CAF3151BD94A4CA73660372B5239C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749313, "uuid": "b3367332-95ca-48b0-a9c4-d66d8b70be4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749313, "uuid": "b1b21dc1-9b41-4d95-a97d-882b8653ec20", "value": "24576:t/eR8kMbynWobxxUIKZ6ZZz0doIx9TT2fXy:QRPMgFFxUpZ9T2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749313, "uuid": "15f289b0-fcfa-44bc-a788-6cd70c3e61ed", "value": 1408000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749313, "uuid": "c7dc23d0-ca5a-4e7b-b914-0e1f35778724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749313, "uuid": "850c911c-616d-49bc-b03f-c61143e1a1b2", "value": "Order specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0180044-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628756631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756631, "uuid": "869ca57f-3c31-4bde-9f1a-b15147f107a5", "comment": "Malware payload (AgentTesla)", "value": "99add4f1ea287095123c13d598d78356", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756631, "uuid": "9df92b6f-1d6d-4e4f-8ec8-d52093ad8d9b", "comment": "Malware payload (AgentTesla)", "value": "dab6df8c0c031a8812a6eab3bf8522f43743d8271679ef644ba1028e6d1aaf1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756631, "uuid": "99df8534-1838-4151-a9d1-e4024d70b0ce", "comment": "Malware payload (AgentTesla)", "value": "13ff11bae9e20e305a5afd8b117781e3bd914a9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756631, "uuid": "88fc9cee-fdf8-4b44-b950-38c3b2b64e9b", "comment": "Malware payload (AgentTesla)", "value": "24e7838e662489570ac756190b9d36038d74385ac59a672e1019ae8521991ad051fa6c56a93e10847c593b5f8855d1a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756631, "uuid": "95db9f65-fdd0-498a-b7f1-755b1c7fad7e", "value": "T11164F151B2E89932E9B264716094D6B5862FFC704F3FD9B73744062B1EB02C2CA25E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756631, "uuid": "1c854a1c-3ed4-4f4a-96b3-f53dbdb37c6e", "value": "77554e5daa9478a6160428ce3abe1161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756631, "uuid": "ceffdaab-8dc2-41cf-94f1-79d1e8eb73af", "value": "6144:3xMRiOnc8y13VYglHpiBdnPaRfriOvdsR/nMPBoFjHticFl:3xMRK863RlM7SfriOv+R/nMPBoHtjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756631, "uuid": "891930bf-4bce-4908-8461-a16b95460b39", "value": 306704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756631, "uuid": "ba7fc358-9b72-41bb-a806-8f8096290af0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756631, "uuid": "ef5d3573-c8d5-4af9-96e3-880c461924b4", "value": "99add4f1ea287095123c13d598d78356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d56f99-fb4c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628759251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759251, "uuid": "34e69054-9cbf-4995-9d2f-3f127bc8409b", "comment": "Malware payload (Loki)", "value": "8a8006fefc0565530f63be48c5e24631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759251, "uuid": "2ac539ac-996d-4c69-93e4-556a6474e58a", "comment": "Malware payload (Loki)", "value": "db48dc160b1f48b8939b0d49c5f0bee2a28bc3b340cff62cea8da50424e1afea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759251, "uuid": "b0ad8560-fa94-4ec9-80bd-5b20cb9fd676", "comment": "Malware payload (Loki)", "value": "cfdacf507d4bf932401642dd7c62d8aae6dc65f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628759251, "uuid": "f160fc2a-7c53-419d-9ef1-0566353693f1", "comment": "Malware payload (Loki)", "value": "0580ed8138c9a5463d4c09a31eecdc9fd235619206f2649b89e0e8bf6e4d612f693147e6c36b0b0a7c828d286fa2518d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759251, "uuid": "a6319a9c-e087-496e-a152-5462baba0160", "value": "T1A3E38D3337D8842AE241CAB040F206E98F18F81B4D495D071F51FB9E68F6D36E9E9796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759251, "uuid": "96264592-7090-4ba9-b5a3-d401cefeb713", "value": "59e6745bf35b42f470b21adfbf2b29c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759251, "uuid": "0f5461ea-a17a-4b08-91e2-f66e0f2689d5", "value": "3072:gxEJpxEqxE2wzwcqvJRFwasAe3crw9xEAxEKxEJ:GEJ7EAE2Uqh0+6EmEgEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628759251, "uuid": "10270f0b-15e8-446a-9150-f2ada5caa164", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628759251, "uuid": "1eddce43-7560-4457-9cc0-312079048518", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628759251, "uuid": "7073a494-a2c8-4cde-8f37-03adaeb58ae6", "value": "CERERE DE OFERTA 08-12-2021pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d99a1d1-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628737971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737971, "uuid": "7db68d13-9fac-44fc-80e8-b89b82c46e43", "comment": "Malware payload (Gafgyt)", "value": "1a0c62ad98e54105a156a1f2d3309ae7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737971, "uuid": "54652b02-6711-499f-b37f-99ceeea55da0", "comment": "Malware payload (Gafgyt)", "value": "db4e7caec703ebb72d9d760086c0ceaa9f959b256db26542967144bda841131f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737971, "uuid": "ec9917d3-efe9-4796-b14f-4bc4645ba419", "comment": "Malware payload (Gafgyt)", "value": "a5d608b718b1620044a66c2640c0cce5208ea135", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737971, "uuid": "2cfcf383-3071-4980-a81b-ff6c23925d5a", "comment": "Malware payload (Gafgyt)", "value": "840fc29af835d4e9c2cf2acdb685123ed1e5666629fed1ec1216e85043fe48277aa192dbf5609df502d4585b73de9f34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737971, "uuid": "373dfc11-13a0-473c-8b2b-c755592ad6a1", "value": "T1B9734B42E652CAB3C8930BB6029B5B264A31FC3A1E2B9F59F31D7CF49B124C87217355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737971, "uuid": "4c6d63c1-2d0a-476d-aba9-18801f92ddf2", "value": "1536:0+xNVpyQWuKv8xKBnq5PeOj5zMLTamLI2VOCjXUfJRk:nNTI30xKBnq9eGsamU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737971, "uuid": "3bd0d13c-9e7d-4dda-882d-b31266eda18c", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737971, "uuid": "fa07c212-b935-4279-9526-aacbb8c9900e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737971, "uuid": "a3f58438-7245-4c6e-a906-6e7948acfc08", "value": "1a0c62ad98e54105a156a1f2d3309ae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c359ab-fb5b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628765504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765504, "uuid": "b0c445fc-7cd2-4694-be64-c1d2b90e479d", "comment": "Malware payload", "value": "40d26f881c7626ef6b69d3e1b2a0cdb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765504, "uuid": "2aba9f2c-2325-4c9b-88fe-754615fe2cf0", "comment": "Malware payload", "value": "db5011b16509afe1545daf23cc42b1bc3ff1a6b8efbe2d3f610b9cdde1681160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765504, "uuid": "611f1e64-0136-408d-af24-65dbc0da461b", "comment": "Malware payload", "value": "c350792bdf2c1d4c3ef26b9cf463dbbe1ba77ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765504, "uuid": "547950e5-4a69-42e4-90b1-b0d96df0d51c", "comment": "Malware payload", "value": "484ad66afb5514f54e816fcbfd0f9bbee0e05e70fdb9c9cb09a54d9af9fd60a139c5e8d0adaf34101f90fe65b90b024c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765504, "uuid": "cd21a43f-5033-4424-8069-ab63d7fb2f6b", "value": "T173645B2039FE901AF273EFA54BD475A6DA6FB6733B07A459109203874713E41DEC1A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765504, "uuid": "47302c1d-29cc-4e2d-9ecb-426aaf30fc06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765504, "uuid": "100d5047-b6a4-44af-941a-cdb2b0141ca5", "value": "6144:hFSw+DqFLpftpvkiNEZKpMHqO8/78HDua66Vm6QYThi9WIFzlkbAAqnVD:EeFLpftpvpeZKpMKOk78juaHQ6QYTUWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628765504, "uuid": "741a54d0-4050-4194-9ce5-ed130b5c9ed2", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628765504, "uuid": "3c371e37-d624-4baa-a871-dfb9be86eed2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765504, "uuid": "ef3f062c-1ef4-4c6a-8557-90a193103593", "value": "INVOICE MALBROS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e6e5a6-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767078, "uuid": "c6a22b78-81f1-479f-8eb6-837f935d7d8c", "comment": "Malware payload (Nitro)", "value": "23e8858a3f412190e31be918bb91c72b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767078, "uuid": "68b59ed5-c5be-45a3-abe8-08c2916fa0e5", "comment": "Malware payload (Nitro)", "value": "db6ded62d80e29a35b0a3fd6613fea1e65cc3cece41c6e281426d5cf5ff77e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767078, "uuid": "7ad8916a-f3ff-4132-a27c-9d66fc437f11", "comment": "Malware payload (Nitro)", "value": "355e30d1259d02a805a5a8d00848413321ceadd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767078, "uuid": "dc48e399-e39c-4236-a4ab-54892ea19df9", "comment": "Malware payload (Nitro)", "value": "cd003b590575d8a5e35b2e6d6cb6ffd4222ebba64b62a0b10815239405cdb68308d396b9414b52e5ec6aa3ee19ea75ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767078, "uuid": "511729fb-81e9-43cf-afc9-228267f6ce61", "value": "T13A53542852738A2DC47C82B815FB2F7C27B0AF565460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767078, "uuid": "925ac734-18ab-43a3-bc24-d255f2dac7c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767078, "uuid": "6a19719b-c8bb-42af-b412-0bead2e83963", "value": "768:9KsMqCXfVcWO/M9ZkiANIU+sYLDwUzc80gmq3oP/oDz:9KseiM9ZkiAPEr/0O8/o/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767078, "uuid": "b07240a5-0c4d-465b-a30c-e99139645904", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767078, "uuid": "806e2f67-7804-403b-9a59-935510c2685c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767078, "uuid": "87a58ea9-6851-4752-8527-aa9782c1fd57", "value": "23e8858a3f412190e31be918bb91c72b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8052a567-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767745, "uuid": "d5111467-fa6f-4786-a567-98e4285972f7", "comment": "Malware payload (Nitro)", "value": "fddfeed85f23b84971cea9b28a9f4744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767745, "uuid": "583715d5-5472-4b45-8113-c4d01f7f9891", "comment": "Malware payload (Nitro)", "value": "dbed3399932fabe6f7f863403279ac9a6b075aa307dd445df2c7060157d3063b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767745, "uuid": "4cad278b-6c9b-420b-b902-c9a2e8e6f9eb", "comment": "Malware payload (Nitro)", "value": "fe5fb6eda0f25239bc0b83c8b50bfbad95f74386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767745, "uuid": "ec865f5b-fda4-456a-903c-64115cbe735f", "comment": "Malware payload (Nitro)", "value": "298e15c09fcc1070dce2d78ad217c54b5534805c00e119fe8a7ef5a2f462c7443e8f17248a1c86f331d933527c7d5565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767745, "uuid": "11c6017b-1344-4d04-9f10-f419cbc75a1e", "value": "T18636532852B38A2DC47C82B815FB2F7C17B0AF565460C75D4A78D2AC3E277B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767745, "uuid": "1e6ad07c-1966-4957-b038-a56088f4d184", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767745, "uuid": "0652fb15-cfbb-4453-b9c3-6e3bda9f0796", "value": "768:E7uMqCXfB0nnpnkWCANIUazGLDwUzc80gmq3oP/oDH:E7uDn1k5APHr/0O8/oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767745, "uuid": "c2df0c72-0fb5-41ab-a3d4-aed410ef7f48", "value": 5138979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767745, "uuid": "8ab678cd-3d70-46fb-9a34-95e62d6ba1ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767745, "uuid": "ca7d76e4-ec43-4d96-9abb-e8a7bb06c776", "value": "fddfeed85f23b84971cea9b28a9f4744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b1ad0e-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766813, "uuid": "dffc192b-59f4-498f-bfdf-6adb65f19bcc", "comment": "Malware payload (Nitro)", "value": "1a4d0f0002036b4c77841100a8e05f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766813, "uuid": "11cbfc43-22ff-48d2-af1b-b5a651fec4a4", "comment": "Malware payload (Nitro)", "value": "dc464ff6c0a7512b6c2582f1539176f1eb409e603fecde8a3eb19661eaffe60d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766813, "uuid": "2294a6c0-974a-4de8-86ce-036d60e73df3", "comment": "Malware payload (Nitro)", "value": "a9733fe6b29bfa2aed64a4fc0d9eef7083252b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766813, "uuid": "e68d7896-225d-4796-98ce-754beabfcc20", "comment": "Malware payload (Nitro)", "value": "936fbab9d8a34dec33d4dcffa32f863ddbad722857bb3366e0e407811557fc3d963e724494c9c7b21b5f035da80fc605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766813, "uuid": "da33965d-d617-49a7-b9bb-fcf0266c2373", "value": "T17553542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766813, "uuid": "5cad8283-5c32-4195-b449-9fb2dbefa83e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766813, "uuid": "ea378508-794f-4c3d-9dcc-c8be685196e8", "value": "768:BKsMqCXfVcWlQM9ZkiANIULTYLDwUzc80gmq3oP/oDE:BKseSM9ZkiAPgr/0O8/oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766813, "uuid": "26137f22-e40b-431e-959a-fce13383245f", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766813, "uuid": "3cc8e8d6-8a6c-4771-9981-ceacfd753bd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766813, "uuid": "71a2675c-337f-4a76-bca4-ac97209d4a2d", "value": "1a4d0f0002036b4c77841100a8e05f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfdac33-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628749165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749165, "uuid": "7d661d7f-1273-4cd1-83ce-b8c1801ee832", "comment": "Malware payload (Loki)", "value": "ab8834f395d4aca9c1a396b7fb680ce2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749165, "uuid": "89f0a6be-cbf7-420f-9b83-50a30283b254", "comment": "Malware payload (Loki)", "value": "de3ffdf32862cb4fd8be564c98f3181b0bf91042d38df3dd4c24936ae1e98849", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749165, "uuid": "fa63c3fd-5bf8-4e20-8e16-dfd701e54857", "comment": "Malware payload (Loki)", "value": "9c2e5e7c3803315cca19e47ef3cabe0d01e2c490", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749165, "uuid": "451b2f0b-11b5-4d11-9eee-9c1c1ef1e963", "comment": "Malware payload (Loki)", "value": "3388a8cd0a2e0b78fb592aa58b6d62ba7ce2d033c26136dd2ff40c0eef1aac9053843e3c098bf84d1353b9692d534e8f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749165, "uuid": "9d4b8122-2f15-4b84-bac1-ce27246c4f7e", "value": "T1BA551282A1B2AD33D4AB3239F230ED32CAD18E109163D16FE108B51979B5B7B577E543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749165, "uuid": "b025f893-7fac-432b-a796-463a30528591", "value": "24576:MjVJcW/TlLn/qEampRMWMvTMg5mNv4hvYGoA7PDx49O2F:MxJ/Ln/VLR6T34ghQGoADDeE2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749165, "uuid": "1574d1fa-4a54-4c40-97e6-bd1ada51813c", "value": 1304856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749165, "uuid": "8bb1f6f3-b8ac-45ff-b904-c3ed9925c5c4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749165, "uuid": "246d2a05-9c91-42d4-83e8-bb869ae58e8b", "value": "shipping document.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f89a00-fb5a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628765147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765147, "uuid": "eb0805ef-b198-4b8e-8da4-738c01ba2405", "comment": "Malware payload (RedLineStealer)", "value": "95692ea1f96acdc98fe565323e8a85e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765147, "uuid": "4e4105c5-14d5-4f35-977d-1d1fd633c314", "comment": "Malware payload (RedLineStealer)", "value": "df3731e797b1f9dc07e772747e9fb1a2ca62ca7c8823f3df96eb8c20f6ee0912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765147, "uuid": "a27956da-8465-458d-8950-7945c4208cbb", "comment": "Malware payload (RedLineStealer)", "value": "f51b89233440a81d86295074fbfb3d2958d49325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628765147, "uuid": "374fb869-82f3-418e-97b4-264b8987939b", "comment": "Malware payload (RedLineStealer)", "value": "761f08721cc4687221b657e3ca4a882b531f45bfc79d914a45a7e73f7185507a9a683e0c3df9b6bfd29b98d58a913345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765147, "uuid": "58901b26-64cb-42e2-a826-361bb9b4f3eb", "value": "T1A155E7D95E99D823DAFC38F88CD6C41572B5AC6E880AD20D1F75B16251F37ABCC4218E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765147, "uuid": "e0f5b573-86b6-4bec-8fe1-c817916e4238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765147, "uuid": "bffae9dd-7bd4-41af-b39a-a1e0b23ff9cb", "value": "12288:e8PUAoMZQaktUC04YqZrkPrkxChx4S95dmWT:eW/x6o4fZgPrkxChx4I5dvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628765147, "uuid": "9f93e8a8-74af-4fe9-8831-5968b69733d1", "value": 1311728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628765147, "uuid": "e4cb55bb-9a46-43ee-98c7-b3c3db614ed5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628765147, "uuid": "56065b91-1571-48b2-956b-300b3c2338ef", "value": "Minecraft_v4.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda60ee9-fb26-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628743044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743044, "uuid": "c4c70917-de86-4d29-b407-7271a78f3169", "comment": "Malware payload (Loki)", "value": "2bd3fce101b8fd12fd61c8c77026ea5d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743044, "uuid": "8e31bc49-89fb-481e-b417-f32e68899d20", "comment": "Malware payload (Loki)", "value": "e02b69d6fbadc67b7e3a589a15d3fd4f7d2ac9f7f1dc720b3f3709e859bc6207", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743044, "uuid": "81d65025-9c55-4a8a-bfe0-f2b8bbffe805", "comment": "Malware payload (Loki)", "value": "50b985424c4d403ac149520c25868471a7c207cf", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743044, "uuid": "21ce8770-1168-4569-b82f-4094d3b299ec", "comment": "Malware payload (Loki)", "value": "eb573906585458f1ad7e0efdb41567a74b792188d5cb24d049509a83584c00a1a2868a85e591ac93b5ba815ac58bb134", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743044, "uuid": "7403caa9-5e07-4bed-a064-d330b2b16914", "value": "T1CA64234C6983482EE754E8BF71106901A9DB133BA43D9CFBECD1CB6490639639D76F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743044, "uuid": "8f93be6d-c34a-4601-a7b4-787690ed8c0e", "value": "6144:0D/MMAdkWzhNdallRjumO4DHuFLd10zYrFiSCcaqnqXO0iMyrMKe8U0Q:8lSkuhNdallxuEWrTCPX5fyrM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743044, "uuid": "71eac11e-95bc-416a-9444-11844d1b2fdc", "value": 315072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743044, "uuid": "9d7e8683-a071-433d-b96c-bb235b2bd159", "value": "application/x-lzh-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743044, "uuid": "295c1fec-3224-4dbd-a087-3303d5687162", "value": "Richiesta di preventivo Phonika.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1ceb9e-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628767179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767179, "uuid": "01d611c8-2f92-4558-8788-85823d61b014", "comment": "Malware payload", "value": "0bc5ae5e0021fccd9bff9f64f686f043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767179, "uuid": "4021bb0f-d274-41d7-8d3b-c92e86e7bbc3", "comment": "Malware payload", "value": "e0aca3b1e2806672143d256e87812294fe04f1ea95625979e3b9d64b951449db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767179, "uuid": "204d0a35-2a50-4621-bd74-184971076841", "comment": "Malware payload", "value": "06e779dae148031e6294ecf0cc5e135da09811b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767179, "uuid": "8cb284dc-edd7-482a-9d55-a9dea22810fa", "comment": "Malware payload", "value": "ca10cdaf0dcf6a073df727535a8f63f3b74a2e1e7ab0c7643bef89821247bfad2bb3687a2ec283961987ec0b9ff326b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767179, "uuid": "ddb71250-5a85-4341-8191-fedc59ba1a58", "value": "T1B8E31708132A9AE3C7DC457FC4F0E644D3B0F09A5669F72BB8C44AE1280779F9956AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767179, "uuid": "22626960-13e9-43f2-b0f1-0eb312635ecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767179, "uuid": "ac416909-e6d2-4896-b677-9e1800ae8e28", "value": "3072:FvcjAFss11pSyRNKB2c3XEECZOX0ByrzwZ+Tlttu6OcTy+Dp1jWT39Y7umZZWDpT:Fvt11pxIuZOX0ByrzwZ+Zv9WqumZZ1Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767179, "uuid": "4b46369e-cd76-4a30-8597-261aabdd2792", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767179, "uuid": "6c183b38-1825-45c0-b6fe-3d567cddca27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767179, "uuid": "c8d5a25f-220e-4143-80a5-74b28eaf7fc7", "value": "Kiddions Mod MENU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f8bba6-fb25-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628742421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742421, "uuid": "c0f3c51a-9bb3-4f4a-94ce-cc7a07ab2d08", "comment": "Malware payload (RedLineStealer)", "value": "92b685aedd90d350504624e142c53b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742421, "uuid": "fbbd53fd-74dd-43f4-97df-adf170239b6f", "comment": "Malware payload (RedLineStealer)", "value": "e0be41471fb0457c80e1c8a10efc91c223183838ecadbddd200376cfd9c2721a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742421, "uuid": "5a54a675-52e9-4799-8224-e7a9f88c1246", "comment": "Malware payload (RedLineStealer)", "value": "ab0db0c63accdd0d6b83f995d302b5885c60d9ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628742421, "uuid": "7023b8b2-ecd0-432c-873a-26ce66af64af", "comment": "Malware payload (RedLineStealer)", "value": "e8aa52b7ddbf3c704c741a61f199e256ad4a8aded0b948f10e33b8319e12b51f19a5d6c5d152ec1b3e355d159eb13fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742421, "uuid": "5663a969-0e5a-4fd6-92cc-84724743e4a4", "value": "T1B9648E30BB90C034E5BA02F845B9937CA92D7EA1573450CFA2E52AFE56346E5EC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742421, "uuid": "2580cf16-bd0d-4080-a42c-5b53a62a3aef", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742421, "uuid": "63b4dd77-8c8e-40f5-9e12-a6bc8bd4a7b7", "value": "6144:W3LUwlxlvZVzy+tToUvqnKmtN4Dc9LysLyXZZroF5w:xwl3XzyqU1nKmtKcNysLyZroFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628742421, "uuid": "373c4483-6b76-42e7-bf3c-4b055b9c2da0", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628742421, "uuid": "f0088619-acec-4899-8ade-3f7f57b7d8c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628742421, "uuid": "01143b41-0d55-45e2-8d90-847416c7712f", "value": "92b685aedd90d350504624e142c53b24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c350bd-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1628776109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776109, "uuid": "74cb0e6f-d714-44b9-9f3a-15bb4af990f9", "comment": "Malware payload (Socelars)", "value": "453b1f8024eb2cae23617bf7b1721a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776109, "uuid": "2a2885e6-61dd-4757-9586-fb2e9c7c8062", "comment": "Malware payload (Socelars)", "value": "e14f4ccdd8da390ab4170e041b4654e51b229b6d925b6366596ec3fc1365d860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776109, "uuid": "a6644de2-480a-4aa1-a7b9-96abeb6d0479", "comment": "Malware payload (Socelars)", "value": "5fb3e994d80f67e9ccbf1548a1d989872de6b7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776109, "uuid": "bdeaf4ab-ddc9-483d-9dc9-808356ece76a", "comment": "Malware payload (Socelars)", "value": "c2647055ef69aaabd34b702b1f8321944663200b669da08f231d9d5a1983d0f8b4c8e91095d4e4cee53bcff405e3b6b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776109, "uuid": "40cf53b7-b4de-48b8-8951-7f20a76b24b9", "value": "T1F6659F21F6429036FCE301B686FE467F8D2CB631131894D7E3C419699E619E27A3BB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776109, "uuid": "e1d3482b-3fdd-4d9f-9e00-15d416c0bad5", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776109, "uuid": "b53b0b4a-4823-4266-8017-534ef18711f8", "value": "24576:TIVFA1pqtg/TnMbX0lwyh0FVmEByA1swFYyOsdwsuQOSIt21QbYfS0IP:CFA1pvTMbOwa0TmUqMYEOFQOSIsQbY6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776109, "uuid": "c719cffb-0082-4d1f-94e9-97bc071dae1d", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776109, "uuid": "d48491ef-b5e5-42c1-837d-01ab109505ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776109, "uuid": "39742bd4-9ece-4c08-808d-dd67e2ce9558", "value": "453b1f8024eb2cae23617bf7b1721a7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627fcf19-fb95-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628790458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790458, "uuid": "51fb8e4f-bbf7-4d6b-a788-bd70f367db45", "comment": "Malware payload (Smoke Loader)", "value": "05523e42fe8bf3e23b70e1bb33946f5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790458, "uuid": "666f6822-aed4-4441-954a-83538c415de8", "comment": "Malware payload (Smoke Loader)", "value": "e168662d0e8575572bfa981af0509029853c5d5fdee0c8dd0d5b9b74813400bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790458, "uuid": "c3dd0c29-7873-465c-973e-989745e36ff4", "comment": "Malware payload (Smoke Loader)", "value": "7e4d935378c165a24cc9ec147fc99ae126b052c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790458, "uuid": "9f2d1e4c-3b29-4d3c-b593-90dcac06a1fe", "comment": "Malware payload (Smoke Loader)", "value": "90a12474cbc3f3187ad123fa7cffcde32e9b3ccceb78a159e5a7751fec13e30cb3ab2ecbbbef27c2e51ad6ac6f2fb494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790458, "uuid": "bf702e79-aac5-4889-a949-d78b3f371712", "value": "T17364AD30B690C035F6BA02F849B693BDA52D3B609B3491CF93D51AEE47346E4AC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790458, "uuid": "595a47ff-b2af-45a8-81cb-c34842126b76", "value": "c4bbba65aaf569dae0a87d41cd5cbbf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790458, "uuid": "6b0d051b-401f-4538-9f0f-dd065c6eb73b", "value": "6144:zUVOcNfxR6pFCuIL1/4Ccg71mmL6cb01J8f3gWxp7B+Dv2KMKT5Ib:cLX8HjIL1/4G1mmL6cb0sfNf+DOKMKTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628790458, "uuid": "5050f151-9a7e-4d06-996e-b8afb4990b16", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628790458, "uuid": "80ffc993-693c-4d23-adf0-30d8c5305b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790458, "uuid": "eb1ca857-e879-4abe-9d27-c3c4b17514d0", "value": "05523e42fe8bf3e23b70e1bb33946f5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e58d96a-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767312, "uuid": "57195ae1-d875-472d-84f3-831b97f22027", "comment": "Malware payload (Nitro)", "value": "5140eb423450693d58b6dc0b9607ec12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767312, "uuid": "7bdd041c-4d0a-4cf7-9691-372a58a36c80", "comment": "Malware payload (Nitro)", "value": "e179f228bff619054e5f1b541afd7d57ba357562518a1490c1604024c50d481a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767312, "uuid": "5d7e66cf-423e-4ad6-8e9a-76e3a099a2cd", "comment": "Malware payload (Nitro)", "value": "be85df18233c01ba73de65bbaf4b21aea298ba68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767312, "uuid": "4c8f0c30-d6a8-4294-9042-b15844cf954a", "comment": "Malware payload (Nitro)", "value": "c028c598ecf57073e6cb30b04d250561840caed705b10ec1822f9f4a0f53bcb3a2b975d28c83b6cdf723059a3fc576fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767312, "uuid": "930842f9-3951-4fec-8a61-0e1eec2f8c74", "value": "T16753632851738A2DC47C82B855FB2FBC17B0AF165460C76D4A78E2AC3F267B78D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767312, "uuid": "86d28b35-9b81-4e61-ad46-d9564fcdcd83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767312, "uuid": "0554a06e-35b7-45f0-bc63-967bf6ce9bc0", "value": "768:PEN8AJTO7baeJvANIESkwILDwUzc80gmq3oP/oDq:PENpOCMvAx9xr/0O8/oW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767312, "uuid": "dad86e1a-3742-461a-9023-8058c1d54ff7", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767312, "uuid": "7b9a5fb2-3d65-4c5a-93cc-9fe515d142a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767312, "uuid": "966304d1-2522-418f-b327-5bb99bd76d40", "value": "5140eb423450693d58b6dc0b9607ec12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacce74a-fb84-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Neshta)", "timestamp": 1628783278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628783278, "uuid": "590ac34b-ea11-4e27-94b3-0f34bb0167a6", "comment": "Malware payload (Neshta)", "value": "a273769580afb4aa1507b3013e29bc18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628783278, "uuid": "dd19ec29-8fd4-4647-b6ac-e120268739a6", "comment": "Malware payload (Neshta)", "value": "e1b0ef4dd27c829683569165d98c902a8ed2f2eaa95b1540c6430f5ea3be0b3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628783278, "uuid": "bb3b7eb4-21da-4635-85cb-431b6410784e", "comment": "Malware payload (Neshta)", "value": "24da0482455c26915d7ecbd60a053aaaa2c24e8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628783278, "uuid": "757a389f-a157-4fc8-9a92-544756f360cd", "comment": "Malware payload (Neshta)", "value": "b96939191edfd0ca6678c7be3998a309cd65468a1bfa4531492fd6a0cf61c34e9257ef87e08a80c4583dbe145d381443", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628783278, "uuid": "60a2fb40-dbd8-45ef-9a75-912b26f4e078", "value": "T176756C3C19B92637C0A5C6758AE18817F0449CAF31D1A9BC94D67F66C3F2A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628783278, "uuid": "28e81310-e209-49de-b432-cefbec700071", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628783278, "uuid": "40585475-7220-49f5-a8d8-656d161c1e5c", "value": "24576:CogSSUG+2/hqtE16R2eU3pd40lZZS5R0:p+Usw9RIpdrl3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628783278, "uuid": "12cf01e9-b51c-47c3-9e87-b42ddac32a69", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628783278, "uuid": "1617f6e2-17a1-4a5c-8fe5-54dbb7395e34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628783278, "uuid": "ddec9b4a-7965-411c-86f8-14f74e84f852", "value": "a273769580afb4aa1507b3013e29bc18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d71458-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767531, "uuid": "a25f7731-9266-40b9-85a1-90ba26df3a14", "comment": "Malware payload (Nitro)", "value": "bab1c700f8d20c7f2a07dbcbbf10bffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767531, "uuid": "06bc01e8-9b90-4a50-a514-3680b2f74c41", "comment": "Malware payload (Nitro)", "value": "e1bf3991afb30d3da6f2302683385b2cc87579d5670b22f9b42a0741e6b851d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767531, "uuid": "76998d27-83be-4dec-bf49-206d2b78755b", "comment": "Malware payload (Nitro)", "value": "de287b3448a1a18a1bc7bf05216b8dc8c551e1f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767531, "uuid": "608573cf-aae1-4692-953a-8cefc0c8af45", "comment": "Malware payload (Nitro)", "value": "29e97b00e5248a359f4475863ea8d60fe1f6f1b0644b60c7deec55f2fa2ac88eb8c172481978cb3879bd4131fa6de910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767531, "uuid": "82ecae29-3cc9-4ca4-839d-637a69e9e44b", "value": "T1565353286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767531, "uuid": "61cab8d0-c946-4d4a-bcf5-5a271a86ff18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767531, "uuid": "0d37e54e-d85d-4af3-9676-403554118f48", "value": "768:HOucKn7n1JMDNANIUsDvLDwUzc80gmq3oP/oDt0:HO2MDNAP4r/0O8/oB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767531, "uuid": "54394da7-974d-4383-b2f0-6888328dd2b0", "value": 62080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767531, "uuid": "491d338b-30fe-46a2-bab8-97eb4d1664ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767531, "uuid": "790957ea-59ae-4d84-9c67-e037d5e7aa19", "value": "bab1c700f8d20c7f2a07dbcbbf10bffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33ff747-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628767052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767052, "uuid": "f2cb0b3b-35ab-42e8-8340-1dd22abb1ffc", "comment": "Malware payload", "value": "14eb758c5d2b3c92b4ec3638c0af9223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767052, "uuid": "d0a36273-e68f-4cca-8cb8-aea09e921e87", "comment": "Malware payload", "value": "e27e216fda36a322917886b2d16c71495fdc7b85f21a7b684468305f32bcdbd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767052, "uuid": "2eb3622a-3088-4c72-afe6-b46d085f7315", "comment": "Malware payload", "value": "b48ea3d8ea0ac281759d3fd394405b650125b4e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767052, "uuid": "3b2b1873-be73-406e-90f4-97869a29e932", "comment": "Malware payload", "value": "be2e1aed09aa649dca2b8550f2179e77a7ca454a8f4bce952f38182cd257061c325d4c54fc3d7ecd3cb7ad8ed7ee601a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767052, "uuid": "433fd4f3-730b-430d-8ada-dde31e030fc5", "value": "T187542368D5F5172FDF595AFEC4CB66991A1C25F78932EB9B3008240D1FF63880942A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767052, "uuid": "d1d93ab2-e4a2-40ca-b4ba-362fe4fe8423", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767052, "uuid": "bb553fd7-e9e8-402c-ac66-003af322a4e2", "value": "6144:5vL5COO4Y4McCFtgqP5bDrT6TxDqDTSBaL5NRx/Hq6cNwn:N1CO24CsqRbDP6UDTSUTf/HrcNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767052, "uuid": "e92a98f1-4c89-413b-904c-f6e3160aea7b", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767052, "uuid": "a178d9df-7435-4187-85ad-388020a66d56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767052, "uuid": "17dbde72-1dde-4813-839b-77b25b0a7ad3", "value": "14eb758c5d2b3c92b4ec3638c0af9223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f9c85f-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767155, "uuid": "d3aa2e60-3363-4884-b20f-a895a1baf121", "comment": "Malware payload (Nitro)", "value": "58e8383642bffde609ff436d8a580d5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767155, "uuid": "e84829a0-9dc5-483c-8eb4-3130add2f690", "comment": "Malware payload (Nitro)", "value": "e288a90f416d1938d8bb7ea68a44d0c33213b12e5b217cbaf98a62903c1f4a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767155, "uuid": "51b0449c-1074-4527-864e-a0e0b57e3192", "comment": "Malware payload (Nitro)", "value": "624d1764d2e80f2bd17521f5f1fa84c54752f01d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767155, "uuid": "565ab72c-6ceb-4103-aeef-c70a68dd5bca", "comment": "Malware payload (Nitro)", "value": "15a24e1d6f78d7cd48dd66242d6b25c5758f3449623e62df35262162567a0be4cdf6887c4576972e0bdf8dd2f778d73b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767155, "uuid": "6b5127da-6173-4441-8879-6cd41b27d9b0", "value": "T1E35354286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767155, "uuid": "ef4c6d04-23c6-488e-a255-9405f0480285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767155, "uuid": "73f836df-2330-42cd-90c6-0c2f70f3df56", "value": "768:HOucKn7n1JMDNANIUsDvLDwUzc80gmq3oP/oDt:HO2MDNAP4r/0O8/oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767155, "uuid": "e4d64f8b-f27d-4676-b220-a7db009e35b7", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767155, "uuid": "3607fda8-6453-49a3-96bd-947d5b6a13db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767155, "uuid": "6ba157cb-ba82-444f-8789-4013c0ec12d6", "value": "58e8383642bffde609ff436d8a580d5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda27884-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767526, "uuid": "21596ff3-e6e2-45d7-9099-34de74344480", "comment": "Malware payload (Nitro)", "value": "b8a4efb8c632745ee9568ecf69e4e0dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767526, "uuid": "499e01ad-b145-4b14-82ff-0b19acefec6e", "comment": "Malware payload (Nitro)", "value": "e28d8463238a1feb09ac2aef20ef0d737086337d2d2797744f113cb061cdac26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767526, "uuid": "b461fe1e-b4c8-46e6-9c59-aa4c7d4eaa10", "comment": "Malware payload (Nitro)", "value": "add85cbfe0e370ca6bed9513592863c23da3c41c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767526, "uuid": "996972ec-c8da-436a-b879-9634aa65b84a", "comment": "Malware payload (Nitro)", "value": "30bc848cb874877a3f447b891ebbf9461ed868bd58ecad818d4ce2d3661948e10921b73b3d0c6b70498c0e051929b40d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767526, "uuid": "0a9aecea-8507-4315-99e0-0da94d77f45a", "value": "T1695354286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767526, "uuid": "d7bb8f66-a83f-45bb-b931-2007691fb55d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767526, "uuid": "c8349cab-d28f-43be-93c0-6e380df9b27a", "value": "768:cOucKn7n1JKDNANIUhvLDwUzc80gmq3oP/oDo:cO2KDNAPJr/0O8/oM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767526, "uuid": "6fd319ef-fe33-42c4-ae74-901f51dc80aa", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767526, "uuid": "18934702-5781-4f65-b118-fc6e3857025d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767526, "uuid": "96560346-d662-45b8-89f7-5492e5a0fcda", "value": "b8a4efb8c632745ee9568ecf69e4e0dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b826f74-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628750476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750476, "uuid": "f1d8e00b-84f9-43ad-9fbc-fcf838adcc54", "comment": "Malware payload (RemcosRAT)", "value": "fa24f9da95f1fc7861963a6f7b023b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750476, "uuid": "c2fbae85-7081-42c5-8a16-d040a26614a2", "comment": "Malware payload (RemcosRAT)", "value": "e291787eb38a6bd40ca70158d8873ee4f9d8efe22906edf703f0ea2b8af3c248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750476, "uuid": "ae0a73ee-4ecb-493e-9cdf-b3351ba8f67c", "comment": "Malware payload (RemcosRAT)", "value": "fc374ac00c7d1f6c1ccba36cd0a15347093597e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750476, "uuid": "b4c3af06-8cb4-45cd-8ea9-a72ee5829ab1", "comment": "Malware payload (RemcosRAT)", "value": "264f673de753e279870e2fc6529544383ae378a3fb55962c2ee4c45b3db447d45c6ac0abc222225f34cc9b6257c575c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750476, "uuid": "6d7b5c8a-04fc-4b11-a75e-2d07ae99835b", "value": "T1F435E05C36907ADED937C932DEA81C20EB78B4B64B1B9223A057116D8D0FE57CF205B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750476, "uuid": "2e2e9a18-e6d5-4d84-b6b8-7ad11c62c09c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750476, "uuid": "8cd59860-f8fb-467c-bf76-3eb8e936e13a", "value": "24576:5IZhz+5Biv4lGJl39zRvpRsw6LLAnqrkh:5ChyivBr1Rv4w6vAnqgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750476, "uuid": "8a0ba493-b047-438c-a248-da6bf50ac487", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750476, "uuid": "988376db-e135-4541-ad3b-2f504f6ec5d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750476, "uuid": "8addc97a-c079-4bdd-a9fa-cad543a00580", "value": "fa24f9da95f1fc7861963a6f7b023b48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422b8658-fb79-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628778378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778378, "uuid": "6537dcb8-f010-4ab5-9f60-8ae5d7535b79", "comment": "Malware payload (NanoCore)", "value": "7a40d67c8a78ef63bda595ab16f5ac0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778378, "uuid": "16da46e8-7cbd-4b53-9a62-f122a2d12888", "comment": "Malware payload (NanoCore)", "value": "e2baf0f5b01a92323fa0f46207e5b9ae09ec8945ef722b912d3559d43c6e907c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778378, "uuid": "791d4a73-5a54-4a0f-af9e-0a0e08247509", "comment": "Malware payload (NanoCore)", "value": "3a4636fdee0797e1dfa0c5075cb0466c9ea00f84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628778378, "uuid": "b8725232-bd80-4d91-909f-dde1354b6a8b", "comment": "Malware payload (NanoCore)", "value": "f5a3d69b88935d54d6b7d0fcfa4d3bfcdb331abaf04a9ce19f58657f2be37498bc0895aa26ffe0df2add9935969b08eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778378, "uuid": "16f894ff-679f-4007-8b06-7516de2d8459", "value": "T1AA755B3C19B92637C0A5C6758AE19817F0449CAF31D1A9BC94C67F66C3F2A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778378, "uuid": "9f9bd55d-222b-465c-b404-3dabb9393936", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778378, "uuid": "d5b7191a-52bd-4bfc-8291-04bc09dd3bd3", "value": "12288:KsJG6kBgpx60IbcNk+uVD7TgUdnfQu5X7Q6H+Uy1Susr8MmH3j2:M6k2n64EPVY1ZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628778378, "uuid": "57bfae0c-871b-402a-a5c9-cd72e0d1af7b", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628778378, "uuid": "372aa44b-9c61-4188-8ac0-a0517f369cf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628778378, "uuid": "df6c4026-5e77-4305-9957-f2222c9b656e", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6837e992-fb07-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628729479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628729479, "uuid": "4947b394-edb1-4965-8e1b-3c3d17b16f46", "comment": "Malware payload (Formbook)", "value": "392287a24e917681eb8e8f7d82da81dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628729479, "uuid": "3b39a3e6-c59a-4c71-81f8-21f8d96936c9", "comment": "Malware payload (Formbook)", "value": "e416ee852d5b60f138ff40f82b52a6018fd9923b5daf2197cee01f23bba885c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628729479, "uuid": "fb5723f9-4006-439a-8d99-bf0be200ac1b", "comment": "Malware payload (Formbook)", "value": "6a55e317286d3f811ac202c01ea78d38afa5ec1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628729479, "uuid": "e14327fa-46f2-4053-a1af-c78ece6cf9df", "comment": "Malware payload (Formbook)", "value": "39c66205b31cee92a8adb883d9b4e0655780a40e021caad6b1e587bbb1f7595f8658bf256d0d5ae260def13873466ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628729479, "uuid": "1477cf06-9474-4cb5-9907-a3d7f752ce0d", "value": "T1EAF39E36DA41D030E2A241F4F2791B7B893E0D353255A0AAE3E51AE16EF49E5F42D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628729479, "uuid": "d3afdfd8-b13e-4bdf-84ee-ca9c71322a4f", "value": "3072:UtBj56f64TnDXoMJHTPJysbAIOctvoKgDpMlLJVcPTd+Ape8:kL2zoMtzAsb7OctvovNMdJ2PTd+A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628729479, "uuid": "eba5c6c7-3449-463c-a206-f0e93c133b2e", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628729479, "uuid": "e7754b8b-647b-49ef-9ca8-3ac7acbb444e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628729479, "uuid": "466d0f18-9209-480c-82a4-2cf9f363392b", "value": "Swift-scan-MGT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b60659-fb01-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628727057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727057, "uuid": "554afd3b-6ee4-4e19-a89e-62578f10d4e8", "comment": "Malware payload (RedLineStealer)", "value": "2c30e7340666a2b59ee88f5250ab50e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727057, "uuid": "8c7ae6ba-a8a9-44f5-8f71-a9dfc7706eb4", "comment": "Malware payload (RedLineStealer)", "value": "e43b2359f27dde4a5f8de4483f9db4016bdf1d2dd0a93ebdbc6c599b3bcbf889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727057, "uuid": "0558767e-9c17-4de3-8873-59ee6b18a680", "comment": "Malware payload (RedLineStealer)", "value": "2a9c301e0c7696130d997e7e1e063388155377e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628727057, "uuid": "7262de84-da6e-4282-aec1-89055a497c00", "comment": "Malware payload (RedLineStealer)", "value": "f8874aa1a427b5c2d6782475d4014aca1ba527d38dcd9b16c4f6acdae8f43644431006e10937b75e5179806eca8d0620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727057, "uuid": "332c823c-70df-42eb-8101-a4db0634074e", "value": "T18F649E30AB91C035E8B612FC49BA93BCB52C7E71972450CB92D52AFE46342E5EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727057, "uuid": "17675355-248e-4e83-adbb-bcec9d533f84", "value": "346d1123531c92f702a30851f3faa86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727057, "uuid": "e18296bf-2ef6-49ac-8259-b8e08cedc14b", "value": "6144:Ls1kSHxIjmIqIdBFNeKQ+g3G8FB2ZOAHErzbLD:vSHyX7dvYeg3pOZcrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628727057, "uuid": "a7aab9b4-db8d-47f1-847f-85d273efd6e2", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628727057, "uuid": "aa5974b8-5300-494e-aa2d-877dcbecbcb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628727057, "uuid": "2d00a90e-ed59-4e7b-aa28-86b139e122fc", "value": "2c30e7340666a2b59ee88f5250ab50e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e22477-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767343, "uuid": "d9457c09-be98-4c8c-9cbd-812923fc02c0", "comment": "Malware payload (Nitro)", "value": "21472a485fe02d7c04fbd83889fb7c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767343, "uuid": "493620c8-310d-4faf-9b2d-67e32b29faf4", "comment": "Malware payload (Nitro)", "value": "e44c11fa52cccf54dedba94afb4fd2fec9aafde8074e15f98a9bbf2bdbb71ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767343, "uuid": "dcfd5aad-b208-4c1d-aaf7-3823ea43e563", "comment": "Malware payload (Nitro)", "value": "480008de4a8ecdd68e655a5cd6c6959755dbe673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767343, "uuid": "7b3f33d1-89cf-4d67-8928-d9ca3dfef157", "comment": "Malware payload (Nitro)", "value": "0bdbd69bd051d47d2a102b29c00d7b8e00ef6a7abaf67da9ddc1344cc4f3e6ef72d2648453c86d4a1254c5810ff086d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767343, "uuid": "594b93eb-bb2b-4b3a-8b05-69020fb59ebe", "value": "T11F5365286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767343, "uuid": "38deb18d-9137-4cb7-831a-c3cf5f4ac85f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767343, "uuid": "ed746646-912f-41ab-82ce-8f9b39da2c3c", "value": "768:NOucKn7n1JohDNANIUIdSvLDwUzc80gmq3oP/oDw:NO2iDNAPlr/0O8/oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767343, "uuid": "0dbd7577-0d59-462c-8d17-15842d9349e6", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767343, "uuid": "d1c58676-38fd-4c5d-a650-96d86224d99d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767343, "uuid": "43a93f34-4b0d-4c6d-877d-4f25ad5c80a3", "value": "21472a485fe02d7c04fbd83889fb7c31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e94f7b-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738355, "uuid": "43c564e7-5086-4c62-a93c-2a63ef63958b", "comment": "Malware payload (Mirai)", "value": "772befc5cf5c6513d942f31e4c320f7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738355, "uuid": "8226c7dc-8b6e-40bd-a722-d0a552e7e79b", "comment": "Malware payload (Mirai)", "value": "e46fbcb136dfb229dcdb54a1fd565a77ed09223d9986d448ebab300147e96eea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738355, "uuid": "292019a5-9658-41c1-998c-9c395831c1af", "comment": "Malware payload (Mirai)", "value": "53bef53b873cea011c9ff693467252c064edd89b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738355, "uuid": "59237dfa-a845-4ab0-8594-dc3f943e596f", "comment": "Malware payload (Mirai)", "value": "39ab0874fed4eb7ad08dd77eb1f7ddabe59a427742a5ef00129d40fac395a8d77f0bf77c90b70bcca5c3b569f7bc9e88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738355, "uuid": "456a8295-3b18-470b-bc4b-31a4480d647c", "value": "T18DD2E118B1E62B0AD13A60F581FFF62D0871C54EACCC8AB7A9D4746A5A4DFB137310C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738355, "uuid": "22cde1ab-42b9-4c02-950e-5575d9ed866d", "value": "768:4uH5tyEYkO4uhxG6OQhyXKR92q+cnbcuyD7UHQRjx:tZIEYt4uhI61h7R92unouy8Hyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738355, "uuid": "5f905340-6c38-4efb-90d2-ea3ba4f20ad8", "value": 30888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738355, "uuid": "f6048dd1-e452-4639-9fe2-b865c3592ee6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738355, "uuid": "f15bb2c0-754f-4032-92da-437912c96c47", "value": "772befc5cf5c6513d942f31e4c320f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9f1e9e-fb3f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628753644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753644, "uuid": "7b8505c0-a0cb-4c5b-be49-0d3c01b5dc40", "comment": "Malware payload", "value": "6115c98bf8ddd72b5e812e4724f1f1b9", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753644, "uuid": "72bf9443-0b9d-46d6-87dd-02a0115c95bc", "comment": "Malware payload", "value": "e47802f8f45ef8699743aa5c2e6070787d96a112da6e51f6b192252239a06c38", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753644, "uuid": "22fe7547-f0e9-4c27-9f5a-98dc2c72eb71", "comment": "Malware payload", "value": "104f876a47f050560a7478143267636373ab4d2f", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628753644, "uuid": "aae0b46c-6b72-41af-9ab9-5b0175f2c20a", "comment": "Malware payload", "value": "198324bc6ee73b42c447294ee2ec9393b302e66a7ef07b4b39f4a3227d994d61ecc55df8b11ae5a5e01d05f93acbe9a7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753644, "uuid": "e0411171-30f4-49bf-afbe-3ae4c8b32172", "value": "T1C37422E092A0C7CDC0A4A07D92F519EE232AE972E132DDD75C61F081B62C1D7EC166ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753644, "uuid": "5e01ce48-6b5b-467e-983f-39e23be17cd2", "value": "6144:Q49HMInvpPbR/5L4YvQ6bgcsEEmi+efMi0oGE0Xx/TTMHfEKVPhsJMHK99zVV9Fc:Q49tRbtp4Wl8cnEQeNGJx/HM/fhhsJMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628753644, "uuid": "878930b4-cbad-4e21-b665-86e6d63b3366", "value": 354290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628753644, "uuid": "27edfd42-25ba-4d96-843d-89bacc9c5c31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628753644, "uuid": "63dc08be-5fd4-4cc4-88ef-2dfee1d16ba7", "value": "Scan_3GD_2021.08.11.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88206b95-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767758, "uuid": "09a5f509-56c8-4769-9070-affde4f14e1a", "comment": "Malware payload (Nitro)", "value": "fe7b5f6ec499c9c1e780c0313ecc63c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767758, "uuid": "921521cd-e80e-4c41-a0ef-21f966b29d92", "comment": "Malware payload (Nitro)", "value": "e5097f9d7958a9ce6fd508b22c1741b9bc5516914b65203bb97e3f4bfd764cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767758, "uuid": "d74ec43b-9c70-410e-8031-e3b3736f9fb5", "comment": "Malware payload (Nitro)", "value": "e1a26c44cf96bf2b6c1ccf66736fc5fa9b46d134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767758, "uuid": "f11782b3-da14-4061-9b36-fc039871bcd9", "comment": "Malware payload (Nitro)", "value": "8b277896a879105d799311d3f1366b1ff85d16ed75f661801506e17b6a9ecd9c1d1666a3ec82384d30cfd9bd77ad20ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767758, "uuid": "4ec0253e-347e-4134-b23f-a51ebc76a700", "value": "T16D53542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767758, "uuid": "6556548b-cd25-4e2c-995f-1ec1534b5eeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767758, "uuid": "35791145-6fcf-4aaf-928a-e4be7bfdd18c", "value": "768:CKsMqCXfVcWO/M9ZkiANIUK+3YLDwUzc80gmq3oP/oDw:CKseiM9ZkiAPKZr/0O8/os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767758, "uuid": "c3f43775-aaa2-49a5-816b-bc31142a8d93", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767758, "uuid": "9317a350-ab2f-4143-95a0-abe4a38f930c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767758, "uuid": "722533ea-4ab2-47d9-86f8-bcb236fcf8db", "value": "fe7b5f6ec499c9c1e780c0313ecc63c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0322b67a-fb56-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628763240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763240, "uuid": "b6c959f9-e037-4c0a-9fa5-deb3124d69a0", "comment": "Malware payload (AsyncRAT)", "value": "a734e792cd7ae1fa62808f559e125655", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763240, "uuid": "0a9bb7df-d7d7-4cca-bd2e-a443cafcc5dc", "comment": "Malware payload (AsyncRAT)", "value": "e5a6c4d10951823971b02b5a710c7aab484fb902b1e50f563a2dfccacfab4b63", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763240, "uuid": "6f0d2a79-96e8-4c24-b2ae-95c9c1fe8c97", "comment": "Malware payload (AsyncRAT)", "value": "6929deb8daf3c1465584ef8fd0bd80240d98bdbf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628763240, "uuid": "8cd883c7-8a6e-4371-adbe-8403839f1b4c", "comment": "Malware payload (AsyncRAT)", "value": "61da73f94f84152e42d56e66106554ca71d1e53a761348461ad8dfb2d3fa60e64fa3224e70c5a755085fb1890023bf2e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763240, "uuid": "c0752691-9cad-460f-8699-c25967d028a6", "value": "T1BC93A25671A56F22DDBD83F109BA619407FE79BB7032E31D1CE7A0DA1174F118A80EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763240, "uuid": "4534390b-6eba-4a49-afb6-01b9bcd9f8ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763240, "uuid": "80259723-c1b9-442c-be6b-a054bdef377f", "value": "1536:hJcHnMnTuSRGi4qcB68PZQDGA5K6NIgCu3jFM6xpI5Woj:hCHnMqSRGivCu3j3xpI1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628763240, "uuid": "8b3d8606-af75-4b52-bafc-5dd87de951a4", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628763240, "uuid": "282d58a1-eb6b-4264-9834-f8cfa9dc1bdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628763240, "uuid": "b0af1d9d-e8f3-4aaf-90da-f7725c48d786", "value": "RFQ Nuwater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597f3d91-fb95-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628790443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790443, "uuid": "bf738eed-b65b-4934-937c-e8846182fb39", "comment": "Malware payload (Dridex)", "value": "71952205cecb999dbbaebf2264c006b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790443, "uuid": "d8f13fa5-b39f-4651-ad02-acc0f3336941", "comment": "Malware payload (Dridex)", "value": "e5c88a3b3c7e335b83b9823248efeafcc25295a80cde517869ced7580c90a65c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790443, "uuid": "43280565-cba8-45fe-bda2-6d2ef85b9cf4", "comment": "Malware payload (Dridex)", "value": "63e5d5bbb6a7e07e72715d0743f4ad637905f8da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628790443, "uuid": "be57353a-5ca3-44c4-a520-7fef35e43ec5", "comment": "Malware payload (Dridex)", "value": "43ba7c851a218f269b22d6eaf907350781b422ea0561e6522dfe1e15f0bafc5b3c8a6c587cb61061f6a0bac456155de6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790443, "uuid": "0c7e3c2a-28ab-436c-8a0f-d0cd4f4851c9", "value": "T1E104C090D9EBE5E9E09E5ABA5C7BF23F62685B578720CF5BD364C71CE6A2D4010E1300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790443, "uuid": "a22e4757-1379-473a-bef5-b29d286a8707", "value": "1691313ae64e22216ac678d4d81d8bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790443, "uuid": "a93869db-155d-43ea-a7a4-6b61c9f927a8", "value": "3072:4JQ6H3ykY88YOSs+k1TwEuTcMIznNuOzlr1Xznku9Luk0eJww8JSa//2uFrSc:VfYOX+wTScR/Xzku9LVw1uG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628790443, "uuid": "53e095db-7305-4d7e-bcb6-4f7d93f570c3", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628790443, "uuid": "1a1cbe01-d32b-4912-a875-187d1f6f6704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628790443, "uuid": "14761041-a158-49ab-84e1-bbaaa9168713", "value": "71952205cecb999dbbaebf2264c006b0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41839a4-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628756638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756638, "uuid": "072e2d62-3cf3-44df-bdf9-5b6da8681448", "comment": "Malware payload (AgentTesla)", "value": "4611c4f31fbfe87807a66c6de9b1e3cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756638, "uuid": "842c3eb9-f205-40c7-a5a7-45e4e4b6344d", "comment": "Malware payload (AgentTesla)", "value": "e6b82640ac2c3968c8e46825799a6d8cf13dd9015bb61a7895ea1a0e642c2550", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756638, "uuid": "4f492e40-d464-43d2-8213-6bc098a26750", "comment": "Malware payload (AgentTesla)", "value": "3c972ece41f7336a81663db5961de115407f6806", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756638, "uuid": "ac145d80-5952-4f73-bc54-b6920338972a", "comment": "Malware payload (AgentTesla)", "value": "7d88e3c8dce370d64f9bcca2433988325f3a5fd4248d92bf872d2ade4fd87814925b2529efbc0bbd4343f4dc695659a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756638, "uuid": "5f4be84c-cb0c-4b13-8577-8c8955a2786f", "value": "T1CFE402112BE45B76F8796BB54A60745103FBE08B8F32D92E2DD919E90E37F008B71726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756638, "uuid": "d4657cdc-dbd1-4355-81e7-1572b288f99b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756638, "uuid": "ce36bad8-f6a3-4b8d-a2af-a5881e97cebf", "value": "12288:T7xY/HK7zKzNBjPjOLFQmuLIA/8xfJ4bTb9QYHfE0Oqlmg3NGjWBmv:5uNBjL+cH/8xfy7S0bmsBmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756638, "uuid": "644f6d20-5f22-4d76-b115-7be44c99f750", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756638, "uuid": "faee884e-939c-4b1c-a6ac-234ec1bc754f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756638, "uuid": "33885e03-c8fa-4b84-90eb-a93f5c782806", "value": "4611c4f31fbfe87807a66c6de9b1e3cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b776cf-fb7f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628781142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781142, "uuid": "d72e5915-9d05-4cf3-9aa4-c83b165e4875", "comment": "Malware payload (Formbook)", "value": "7f315c83910b3a196c1fb30475e5101b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781142, "uuid": "e9534a1b-88ec-4656-90d8-27d26d1fdcc8", "comment": "Malware payload (Formbook)", "value": "e759a4a906a9496f6b9f60b90e7ff49ef812090ce465108f08d32ac916e20cff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781142, "uuid": "6760147f-f302-4c39-92f3-04afad0bee9f", "comment": "Malware payload (Formbook)", "value": "899b5855776737ee0115da31a5b58a4f89bf73a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628781142, "uuid": "0dcaa244-e466-4794-b604-0fc22fa42858", "comment": "Malware payload (Formbook)", "value": "d42fbf015ff2d6cdc3445c4938be1fd5f917aae4c70fabd2df1be7ba845d5f452539d1367ae42c511be35b8ae9fe493b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781142, "uuid": "b53498ee-3f19-48e9-abc1-86a34e785a5d", "value": "T170755C3D19B92637C0A5C6758AE18817F0449CAF31D1A9BC94D27F66C3F2A5335832EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781142, "uuid": "1677f7d2-24b0-469f-a16e-d31daa848511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781142, "uuid": "264f87aa-8306-4dc4-bd09-d332321fb192", "value": "12288:FtxQ6oDjffKbuNb9UnYqmDNBoj28w1f2wt1SdnUtk4yQ6H+Uy1Susr8MmH3ja:honayx9UnQDDY2P7tsdUtkAZZS5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628781142, "uuid": "73db91aa-3053-406f-bb3c-1b46bbfd7cb1", "value": 1588224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628781142, "uuid": "97882094-1b1a-40c6-a2f1-541ecd49f67a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628781142, "uuid": "9c19e643-ca10-4074-a0bb-c60a1385d1f1", "value": "7f315c83910b3a196c1fb30475e5101b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf42df8-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767283, "uuid": "619958d5-0e20-4feb-a6c0-7af5eccf8627", "comment": "Malware payload (Nitro)", "value": "1515cd1c649324c16f3d721ab3f82f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767283, "uuid": "1bda6431-207f-4fa7-8499-26796aca0768", "comment": "Malware payload (Nitro)", "value": "e79ce07285ac744098bb3f82f980ae772d4b0572ac772a033721242a56f5f991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767283, "uuid": "93484352-5778-48f4-87d9-34a73913d714", "comment": "Malware payload (Nitro)", "value": "63b4f5588fa7666e6bb8f8240da41cd72fe1300d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767283, "uuid": "3b20b89e-02cc-4fd2-8891-227f48c59899", "comment": "Malware payload (Nitro)", "value": "524c95c9ddb63a046900dc867c0c31e89d7a67189562179b7edf3f6fd5d84dd8f34baac23612726e05ca6c64f52c0c50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767283, "uuid": "626f5703-f5e1-4611-9468-8678a0085eb8", "value": "T1855354286273882EC57C81B811FB2F7C1BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767283, "uuid": "38f50ad8-dc57-4d05-976a-f935eee0d59a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767283, "uuid": "41e02b21-f112-4bf4-88e7-a6d706ca0212", "value": "768:qOucKn7n1JGDNANIU0LvLDwUzc80gmq3oP/oDT:qO2GDNAPAr/0O8/oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767283, "uuid": "9b585e9f-e6ed-4f44-b06b-70d4cdbd79c9", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767283, "uuid": "efe34409-8bbe-477b-b76a-9f2b4c97bb20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767283, "uuid": "f9afce3e-f506-4341-86cb-2237b5dbec0b", "value": "1515cd1c649324c16f3d721ab3f82f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3968341-fb0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628733068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733068, "uuid": "2a3bd7e3-212c-4d18-b387-66c25f00bd8a", "comment": "Malware payload (Mirai)", "value": "d8648aca14d7c9fb13c4f917276e0625", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733068, "uuid": "8b78351a-46b5-4b19-af92-495620d72cea", "comment": "Malware payload (Mirai)", "value": "e8681cb38fe892140b787ebce3fe1beb1558e6082297556550b0fbb6ab3903dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733068, "uuid": "2a6f5636-cb37-4e07-b479-1dcf032bc263", "comment": "Malware payload (Mirai)", "value": "80e0b6dda3761d5b2c93f295806f605e52407ed8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628733068, "uuid": "cd40c2d3-a419-449d-b1ec-252948cb76a0", "comment": "Malware payload (Mirai)", "value": "80c3b870473e5e629446a1345a42165b6861660afcb565ec756461e7da75283cb50a4e6c0b079aa8afbf9fe37cd3041c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733068, "uuid": "505bb647-66be-4ffd-9e2a-cfb0e6453128", "value": "T1F7738209AFA05FF7E8AFDC3749E91B4525CC651A22A83B76B930D418F34B64B14E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733068, "uuid": "ba2f4289-171c-442a-85d1-ed178faf07a7", "value": "1536:63q0IKmqAc0NL2QWVcpccCLezQsfqZxnyy1:Sq0IkAc05fWVcoSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628733068, "uuid": "c6c16a0f-d484-4633-b5e8-7bb0d58cf837", "value": 76056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628733068, "uuid": "f0cf5085-19a1-4eff-ad54-f853c5f40eac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628733068, "uuid": "f550898f-dd5b-4cc2-98da-e435c4c22627", "value": "d8648aca14d7c9fb13c4f917276e0625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1d9878-fb86-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628784243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628784243, "uuid": "ad38b02e-7643-4896-9e04-60c40ba0d3de", "comment": "Malware payload", "value": "a9a6f9f92f11c78b8fa145edc70db3f0", "object_relation": "md5", "Tag": [ { "name": "PHPWebShellMiniShell", "colour": "#08C0F3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628784243, "uuid": "61e68abd-2025-4503-9ef9-e15009a20f4a", "comment": "Malware payload", "value": "e86c508a5500d7d919dd243192e2ff7c18be7a1a2f0184a371a2e7ab3329a3c2", "object_relation": "sha256", "Tag": [ { "name": "PHPWebShellMiniShell", "colour": "#08C0F3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628784243, "uuid": "708795f5-f854-4243-891d-5f6e6a77c2d5", "comment": "Malware payload", "value": "0a7aa6a3714413b816db7b21902e4363d29e14c9", "object_relation": "sha1", "Tag": [ { "name": "PHPWebShellMiniShell", "colour": "#08C0F3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628784243, "uuid": "7bf3a40e-2d62-4553-8a34-840230485b7f", "comment": "Malware payload", "value": "06125cb552c126dcbc3da2d4ef1b474a84ebda5fcafa84ea3afbee3c0352a477c2778c2d4f4f4fe4102b10874b5b50ef", "object_relation": "sha3-384", "Tag": [ { "name": "PHPWebShellMiniShell", "colour": "#08C0F3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628784243, "uuid": "b46afb84-9472-44fa-9b07-f5cfe6c99af6", "value": "T16BF2D6C54989C9F8CB2FB85452199C67CACEC32A272DD880BBE32F093552DB8757D9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628784243, "uuid": "9a55a2ea-1f40-46d8-92b2-4f550ee7a6db", "value": "96:Zz4qQyUzVcpySPSaSdID9MS7eMSc8d3rJzxQfFNPGGhhdTKFCgG4yKATAYeHs7uV:WPylpDq7GDacA9s6qGxLBruEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628784243, "uuid": "afa778cf-d2c9-429f-ba9b-bbcf36a2c527", "value": 37121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628784243, "uuid": "2b1ca0be-74cf-44b7-8338-b0950d603b04", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628784243, "uuid": "708c8a92-67e4-46d0-86cb-059d41022369", "value": "gXQQKnPV.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d05fc3-fb01-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628726762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726762, "uuid": "7cb962c9-19a5-4569-aa9a-aa22644bd47f", "comment": "Malware payload (Mirai)", "value": "7c90a49353caeef4b6cda0b8c2760e7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726762, "uuid": "95807e5d-07da-4abb-8e0a-9bfd5d583c69", "comment": "Malware payload (Mirai)", "value": "e95fc4de1d7656d1176467e3bc85acc093d1e1d3f98973b8bec5843964d1fd22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726762, "uuid": "5ec5cae6-2a51-40dc-8185-a976594ba160", "comment": "Malware payload (Mirai)", "value": "b879f81384f03449a69f1070973c7e2e4da31c52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628726762, "uuid": "181cb6bf-cd7b-4852-b907-ca0336699580", "comment": "Malware payload (Mirai)", "value": "6a5f6fa3aef48f9ea14c0cd6ca553946f2d4b9d3deeebea48f9b0463df8fc43cef5b5ac232fac0d9da28884f9294e260", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726762, "uuid": "d3bad9cf-b4c7-4f51-b224-7c1ff5788c63", "value": "T166634C02B2280A47E5931AB4253F1FE057BFEAD025F0B689695FDB568635E371086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726762, "uuid": "f5c29960-ab5f-4472-8ff5-b1ab3d4690e0", "value": "768:hcM3+VHuQYRPbMlxkSC1yHyx4cDzPH//1ZsV+8uiFzBjl6HHleKnsbmqVr4sGZMu:uw+fYYC1yHyau3/mRkyVEsPkIOwDEz0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628726762, "uuid": "eda2c345-4c7a-4be1-92e1-1681121e0267", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628726762, "uuid": "9945a7fc-d1fa-43e8-b58b-dd0b4ddf2e0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628726762, "uuid": "9255b337-97c4-4a10-adaf-0ec0ec408e40", "value": "7c90a49353caeef4b6cda0b8c2760e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8e173a-fb60-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767603, "uuid": "12b54c6f-e0c2-4e7a-862f-356610004e71", "comment": "Malware payload (Nitro)", "value": "c51456bf780102a44c95ba51f0879516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767603, "uuid": "af03efa2-14ae-4155-b351-fdc576905506", "comment": "Malware payload (Nitro)", "value": "e969d960fb3a33e3a3eea43fc915799455144e806b0b75e054e7ce8e962c0d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767603, "uuid": "f344605e-214a-4a20-ac3a-2bb727df95f3", "comment": "Malware payload (Nitro)", "value": "bf18df2d657c51366a7d7eb842ef2e0438e3cd16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767603, "uuid": "9621dde6-435c-432e-b7f9-a32d4f33e112", "comment": "Malware payload (Nitro)", "value": "c9fb7a5f34f1fb1972d610e5a0a9c59fb76f47b51265921106655d8603eb72a486f4da3c6690d1ef6f3f129f5c5dbcd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767603, "uuid": "78293be4-4e95-4430-9032-c1e586585f42", "value": "T1F89412503BE15713E6F9A7F4097563282B32EA0B29A2D71A3DCF0DEC475A3498660F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767603, "uuid": "d11ba2ee-0f7e-4f56-9c38-2bbfef799674", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767603, "uuid": "f341e1a9-9d59-4708-a737-da107525dbde", "value": "12288:2eX0X/Ih3cYLXt/UzMUy3wtb1TsIh3cYLXt/Uz:2eXLLLXuxhVLLXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767603, "uuid": "307e1df8-463c-44b5-9778-08a922583d24", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767603, "uuid": "db0989ba-47bf-439d-95c3-3265e6f80ffb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767603, "uuid": "c1025f63-6977-49bb-8e46-dc01ea9eaa2e", "value": "c51456bf780102a44c95ba51f0879516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e59343-fb77-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1628777768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628777768, "uuid": "965245d8-3fbd-48ec-ac15-fe2ce7fd7a06", "comment": "Malware payload (Gozi)", "value": "1770629cd11783f269457ba5263c6acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628777768, "uuid": "a5935b48-cc03-460a-af2f-77cc2660edcd", "comment": "Malware payload (Gozi)", "value": "ea592e67befa6d2e10dd474ed4cda2d075cf8577c82340ae6c6133fb1d5d9bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628777768, "uuid": "bfcba0fe-b518-4a2b-8226-1142371c3633", "comment": "Malware payload (Gozi)", "value": "03be2e20468d4614e877700a40086dad3cb8cd34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628777768, "uuid": "6bf92ffd-b95e-43e0-b74c-3789d5e6ef03", "comment": "Malware payload (Gozi)", "value": "abf4db6e487be6588b1208b902a3fcf783d007f03555b62e5a3bff117ca25373b55e8a2cf421144265274e2cafbc298f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628777768, "uuid": "0784a447-2feb-4cd1-9313-8875dc859e43", "value": "T12C244B6AA3E40595ED6BC6B6CE53D61BE7F274092B14D30F4370CAA66F17722B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628777768, "uuid": "0ec78ad6-b483-4e49-861c-a83d243ba613", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3Lu3y5ZH:cxb5wvtKRvSxY0G+D7u3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628777768, "uuid": "732cabf8-f056-47f7-9c33-54f13bc0ada2", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628777768, "uuid": "648b111d-7dc1-4b10-89e8-34370591327c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628777768, "uuid": "ee9c93d2-a891-4f2f-b027-23353eb44e09", "value": "238ff550000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9861ccc8-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628776375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776375, "uuid": "4904c770-b5cf-4ab7-a59c-a95675debb85", "comment": "Malware payload (CoinMiner)", "value": "3e4d85281c5f75c9c95cb60f02486e55", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776375, "uuid": "adfc65ef-a95b-41a1-96b5-dc6620f2df0a", "comment": "Malware payload (CoinMiner)", "value": "ea5fa5ef3c467341a06dc0c889de3bdfcfdb5e1be338758caff3df9950aca430", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776375, "uuid": "20d68576-8944-47ae-ba66-9ef705f96939", "comment": "Malware payload (CoinMiner)", "value": "4f41597fab01a73fbac1a803492c4571f3235b6e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776375, "uuid": "ea2508ae-6f81-4364-bfe5-f2b65c240b0f", "comment": "Malware payload (CoinMiner)", "value": "bab6292475e17bb698a10b504ead95430ddf05854820d1fcb8e0dec599140861fe2bcb0aa89241d2ca895bda7bc1856e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776375, "uuid": "55f15905-9b4b-4c7b-a8ad-39f686a326fd", "value": "T156649E31BB90C035E5B611FC45BAA37CAA2C3E61A73490CF52D52AEE46346E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776375, "uuid": "273bfd16-38b2-441c-a4c9-8e8e037807df", "value": "368e97c3444afc7b37df6998ab5d491d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776375, "uuid": "b17088d4-3d42-401c-b430-0186b88f280e", "value": "6144:81zbkxOr9w9AU+/gcxEJ2K6yK2rvMEqU1aBBUQlM1TdF+P:CbkwK9Af/LEJ2K02gEqUgHUQlMdfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776375, "uuid": "a4cb9619-5aea-4873-9af1-ec23f1130573", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776375, "uuid": "b5bc8777-88f6-4560-aedd-8c748da76066", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776375, "uuid": "b76ddb20-11e7-4801-9f65-a09de99b9546", "value": "3e4d85281c5f75c9c95cb60f02486e55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec13983-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749086, "uuid": "ca205c1f-48e5-481e-8282-ca64f9e97864", "comment": "Malware payload (AgentTesla)", "value": "73444436aa2a69b9bb1b92a07476f612", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749086, "uuid": "80f50fc5-f2bf-48f1-9d89-fd1a15996982", "comment": "Malware payload (AgentTesla)", "value": "ea815dc254189542fbf41ab0fd55823a66c8e5c71ad15f17737824e4a429c4db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749086, "uuid": "9dab895c-5a54-4da1-93db-0d229735fafb", "comment": "Malware payload (AgentTesla)", "value": "6984d9dc15660d5587b7d1c03c2b55884d1f7261", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749086, "uuid": "6d1505f5-69c1-42cc-90df-5a35fd212f37", "comment": "Malware payload (AgentTesla)", "value": "76576f76e5d1219f6b6898b648e72c397adffd76f20485323d7a5ae87511d605561920b0e5cc4f66726aaa4021d27416", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749086, "uuid": "3bc003bb-9d5a-41bd-82e6-a6919dc70c29", "value": "T11AE4025527E85B26F53E2B7A4661704203FBE4579B72C50F2EC925EA0E67F00CB72722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749086, "uuid": "fd878cfb-6b35-4f9d-b7e7-4a21c258a2cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749086, "uuid": "b8826bfb-e833-4929-86f0-af92dac24bd7", "value": "12288:TdIE/HK7z71Mbl4hRXdbQa1+vCP0EI5m8NEET50pYjTSm4MHPioG9wW9h/i:WX2blqHrCEloYj59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749086, "uuid": "a1a26791-12a6-4a1b-bec9-3bb6e19fa806", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749086, "uuid": "c26baa76-5c42-475c-826c-2f43e1f64c84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749086, "uuid": "db2b8d28-51da-4770-b908-903a31c051ca", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa6abc7-fb69-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628771421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771421, "uuid": "7e8b5300-be7f-4163-a9fc-f198bcaa5943", "comment": "Malware payload", "value": "cb1213277a8cce824dab386deed2a473", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771421, "uuid": "1d78db4b-a55a-4a65-b945-aaee2fa9fb93", "comment": "Malware payload", "value": "eb4bede4fd34447665975c75018c4cf6c2558d3fc456a6600964a02de805b7fa", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771421, "uuid": "3d9202f5-4823-4c3b-95ed-b36e07f0697e", "comment": "Malware payload", "value": "500dac58bc3346b9c8eeb6d62c99c02b71854bb4", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771421, "uuid": "594e53ad-99ad-4dd6-b4a7-7f6509a3a430", "comment": "Malware payload", "value": "e5df3ed9af7f1563c2d085f6c0a6f35e7db209ce4aa2891e2700697fa3d61c2207ab4d2b97962df76218a065075c4396", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771421, "uuid": "2ccccfc6-df0a-41d7-a620-fd424d16d191", "value": "T123E312EE9F58685DA1D9AD912771D700688E659FEA00EE0068FC4CDFDAF0D00AA431A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771421, "uuid": "9731939a-d2c4-4b8c-9dc6-d9c16a8539df", "value": "3072:TZ97hhgwQsR3JXsiY/QUJkX04WSt4xB1Y48V5cwFX9QT:FXi+l78kE4LKBUcwFXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771421, "uuid": "63df5667-1ac0-4d46-818b-e1f2b33f08ad", "value": 155924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771421, "uuid": "1651a425-c6c2-421c-8d25-a11c0c7d2794", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771421, "uuid": "19da5e01-839a-4f91-8fb6-87a0ed7155f1", "value": "INVOICE MALBROS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dac0fa-fb47-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628756908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756908, "uuid": "19721191-2917-497f-866a-3dcfbfd5ae6e", "comment": "Malware payload (Formbook)", "value": "d32c07f78a2d47bd5b916231eae4e322", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756908, "uuid": "23a5873a-7f51-4ed2-b253-f26dea0d0ea3", "comment": "Malware payload (Formbook)", "value": "ec6af3530e12f450657a1a54e44580dfd29e32a46d888c694967573b0796f3f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756908, "uuid": "69f08a36-80eb-4dda-b220-e17a5d4a7849", "comment": "Malware payload (Formbook)", "value": "ec3fdd03be47e7d49b51a579a4645b3733f058cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756908, "uuid": "7277deca-5f49-49ba-a3ba-a96f0ea141a5", "comment": "Malware payload (Formbook)", "value": "a7ec4007614499e8c643e94644e007ce3d6aa266c053779fc54278082057f3d76405f745d9c0248fdc3ce78af377ffc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756908, "uuid": "d7343494-4355-4364-b23e-14e207561849", "value": "T1B3057B3B33DA67FECAB492F9141000974AE299251822D75F2CFDF2CD19247660B399E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756908, "uuid": "92714aba-c464-4452-97ca-8d84c0b360ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756908, "uuid": "100f19e0-d34a-46f9-9123-9fd23b01a3ea", "value": "12288:M5Wx9zuXCzXDUOLl8YWvroHcHuPJnBOU2P:hvqSzDfLbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756908, "uuid": "514ce86c-6178-4599-a062-b0106732b8de", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756908, "uuid": "b8c095bc-7902-462d-aae3-7c3928b26995", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756908, "uuid": "84472766-15b6-41d8-a5fa-3c0d8610fde3", "value": "d32c07f78a2d47bd5b916231eae4e322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0c9178-fb27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628743151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743151, "uuid": "f003d430-e361-422e-a8c5-0c902c0d05e4", "comment": "Malware payload (Gafgyt)", "value": "dbcbdafdc0f13149e8b05ab9ac7020ba", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743151, "uuid": "04ec5e5d-83fb-4efe-85e4-f9cee870cc17", "comment": "Malware payload (Gafgyt)", "value": "ec7931db26b3770d3f44f4aa0021a97337e4a4ec4becb5c518fd753df558dad9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743151, "uuid": "483b567a-48b3-491c-b607-3b461b22f11f", "comment": "Malware payload (Gafgyt)", "value": "4aa6cbae552e7a2495f55fd05207e38f58a88b79", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743151, "uuid": "8c3361bc-5166-4b91-918d-ed180174b9fb", "comment": "Malware payload (Gafgyt)", "value": "a0b8e9b3824c28d4c7cc9550f7e36bd44a6dd63c85951c09f583796c8e8293cf2210cfd50a37246578f58bfc00451b8a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743151, "uuid": "4d0dc9b2-27d1-4625-82ac-feb9b77b5c26", "value": "T16D432B375692CA7BC4D747F517D796218133B8391F236209B3D8BDAA3F269C82E59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743151, "uuid": "f87f743f-06a2-4117-8cdc-0ed4ebd01d35", "value": "768:UzmQ1KeSZaLGjuL3GoxVbsVFWnyVZSgHo3Gk7IfuXYYYnC8439qS/DDrWMCLsZ:N6/HGSDjbsVFWmSg+7QClKNsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743151, "uuid": "5ee2f52d-d694-40af-998f-e6df0d5c411b", "value": 60197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743151, "uuid": "54b53d07-91fe-4b25-a32c-74924d7647d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743151, "uuid": "502fd74e-ca20-4a55-ba69-705a7b56129e", "value": "dbcbdafdc0f13149e8b05ab9ac7020ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2349c793-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628749120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749120, "uuid": "41fc4836-dddd-46a3-a997-82f8486ef423", "comment": "Malware payload (SnakeKeylogger)", "value": "15b9ea706836f9a49e8e682048c076fe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749120, "uuid": "a7edb78c-a651-4657-b3ac-2ed62bc39faf", "comment": "Malware payload (SnakeKeylogger)", "value": "ecd03e928fa7bd244efd88e1064eb22601e6d6b60228731024067f546807ec31", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749120, "uuid": "4497162e-54af-49d8-8232-a5926f138de8", "comment": "Malware payload (SnakeKeylogger)", "value": "d2f6b43b678a73cd147c117441200bfb3f41f194", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749120, "uuid": "a620538b-b882-4745-8e1a-d12ed088d2d9", "comment": "Malware payload (SnakeKeylogger)", "value": "cb4f93596c3e0be40e13fc8838389e43be2cf52a168023d53f88f311f50e480ea5025b4439e61dfd3b7982ca4ae1b9a8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749120, "uuid": "bbda0b73-e50a-40e5-8e6d-bf9688ac319a", "value": "T1DAF3A39CC8AB5694CF45ABB84B3BAE0802DC367EF745493231BC577427D5E3AA10283D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749120, "uuid": "eda49944-47b5-4a76-8980-52711384c91f", "value": "768:7ZVo9RtYh4KX3MiPq3mGMi8SvRX4NOKJ4:giiKX8MQwi8SvF4N54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749120, "uuid": "ccf44aea-fdff-46bb-93d6-d7d8d7dd95ad", "value": 163406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749120, "uuid": "63a5cf74-e056-4367-9ab6-779f180606bf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749120, "uuid": "05f21cd2-37a6-43d7-9051-1169da658cca", "value": "Request For Quotation131435.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ad448d-fb44-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628755570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755570, "uuid": "c1c726a4-5ebd-4c66-8432-23a643c1d96a", "comment": "Malware payload (RedLineStealer)", "value": "e716312f531850811e7dc272e5c6819f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755570, "uuid": "c23d79bd-93e0-49db-a959-992466f8c158", "comment": "Malware payload (RedLineStealer)", "value": "ee4608483ebb8615dfe71924c5a6bc4b0f1a5d0eb8b453923b3f2ce5cd00784b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755570, "uuid": "18985e41-6eb5-462f-bb14-f963895a7aa0", "comment": "Malware payload (RedLineStealer)", "value": "cb707d05116eeefc1e6adf58e8b87c8493e57dfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628755570, "uuid": "fba2704d-0b5f-44e2-b820-7021c1f1faf2", "comment": "Malware payload (RedLineStealer)", "value": "58a5d6adc14717e1879a65cce1766a67cdaad67a76cf8d95a5c721e64c95cfa365d4a24e54e3fc4274228f48dc0715fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755570, "uuid": "8b1eee34-9c3e-4ace-acc4-c6d91e836f69", "value": "T1EAD35AE2D60714DAE93C6639E09AA03F27D5D97EE0A9D6EEBB0343C2785C4522CF51C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755570, "uuid": "c26744f4-c0ef-4bcd-8f03-85f11c910b44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755570, "uuid": "eb2b40a8-17d9-404a-8d3d-97866420d527", "value": "3072:QNLhMGPUhkElI2t8ePbdHQfiX6G8E/fjGK87+ZEyBRN:QTShFt8kHciXvn/LG7+my7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628755570, "uuid": "edb5f439-ec95-410a-9468-2c3d3b177dc6", "value": 134584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628755570, "uuid": "83979ecc-a295-4b2d-9c09-025b7e011c8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628755570, "uuid": "dfc05b6c-2d2a-40dc-97f1-08ab99fb3e30", "value": "e716312f531850811e7dc272e5c6819f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a779fa-fb6c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628773101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773101, "uuid": "6b296093-54b0-47be-8dd0-a5a7762fdbea", "comment": "Malware payload (Dridex)", "value": "87a342f471c2e47e6e5535688df0eaee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773101, "uuid": "7efe32e6-044d-4546-9cf6-5f87867ba48c", "comment": "Malware payload (Dridex)", "value": "ee9409c9e9ed5324f7a6ce9704076d1effa78c9c9de14ae7b8a7bc6edb30abd7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773101, "uuid": "4ebefa69-1158-4739-a328-b9332d5c1f90", "comment": "Malware payload (Dridex)", "value": "e998bd2a617e1f04f9076c20329dd2fb3b5c6a69", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773101, "uuid": "3e2ae5ac-89b5-4c8a-a789-a612cc0716ca", "comment": "Malware payload (Dridex)", "value": "2a4d5306b275550fb9aa9fba2a361c660e592cbc25d3abc5cb48a54c2cc3e5fbac13cddaab6a348ee94750f1708c6954", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773101, "uuid": "68c1847f-08dc-453e-80bc-e3888036cdfa", "value": "T11304E090E7CB1269E6631875152D332264A27F219670EE9ECE1DC62887774236F3E3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773101, "uuid": "72d8a25b-ea8f-4e47-9edb-3ca72e4e4d2c", "value": "c88b1b8168f2947a82592f1323fdc522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773101, "uuid": "cad085ee-e80c-43d4-8b60-e054a099e090", "value": "3072:j1JzSxp5PpRh7phfrv/6jC5KHWnzD7xC3/o1WXDCFUBUL1iMhmDEwmuFWw2F:j1JGz5pX7fz+C5kUzDA36bFUc1i7EwR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628773101, "uuid": "939f5693-5235-4c90-ac19-4db02316e26a", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628773101, "uuid": "5f3efc43-e1ef-4b64-a33d-64a8a5d1411f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773101, "uuid": "cae1ffb5-24fb-42b8-8a1d-7fa6c228e1f2", "value": "mal.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261be901-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628749125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749125, "uuid": "77736c8c-5cfb-408f-88c6-0fb2afbac989", "comment": "Malware payload (SnakeKeylogger)", "value": "39180a5501ab20ff74dedeaadec0e5fe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749125, "uuid": "5fd52d0a-5927-497e-8c6f-306162d18e65", "comment": "Malware payload (SnakeKeylogger)", "value": "f0edb21a9b43fc99c858009b07b27fcc19c80d20e1f1e4667f67b00c869ec800", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749125, "uuid": "2116131d-f131-4724-8bee-1895238a469f", "comment": "Malware payload (SnakeKeylogger)", "value": "d44336e618e21fabc8c5fabf6e3281d3d3b1587b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749125, "uuid": "3f0ac40b-f295-4cef-afc1-ef48c1b3325d", "comment": "Malware payload (SnakeKeylogger)", "value": "6d3bd8af1874136156e511df09ebc42066d0b0713535821e51941b002cfc6ba7cf34d025613fdadebe01c3f2583d3499", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749125, "uuid": "f26e6129-07de-45e1-9a2f-a459937d1317", "value": "T17214B4ACD05702A48F86ABB86B1BAF85014DB62EF785E473726C973057E1C3A8013D7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749125, "uuid": "aeecc1ae-e1cd-4e0b-b43d-1264c4f82e1b", "value": "384:HHVOxI2vR3LRyWfINlVAYWi6Ii8fpkwCmBzWfVs/GyNWv7yE2NVER:naI2vRbV6WH1opoySyE2HER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749125, "uuid": "bec6eebe-6f87-4547-b735-dd15faf8ab53", "value": 194811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749125, "uuid": "58c9b3c1-8902-416b-85b0-180af7c6187b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749125, "uuid": "68711ef8-0138-4f78-8a3c-b974380378c4", "value": "403771641_459803460-001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eda18a6-fb1c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628738349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738349, "uuid": "1ac2c5d9-e18f-4954-8a07-0c46caadc0b0", "comment": "Malware payload (Mirai)", "value": "e0e5475bfb58e6a889f8a0659a85a79a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738349, "uuid": "f4c3a3d7-3a8a-4038-989f-30639e42f621", "comment": "Malware payload (Mirai)", "value": "f1150743b1a2eb8d472d3c4e68200195843e9812fcc10ca3bdd11df19e0d873d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738349, "uuid": "95c1b3c3-0e09-47b0-9c47-0806c93a73ce", "comment": "Malware payload (Mirai)", "value": "22d4c2320fd2d94bae674873e3946116bd99b88f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738349, "uuid": "fc76fe39-66f4-4bcf-a413-00da226e942c", "comment": "Malware payload (Mirai)", "value": "aeb2ec839a18a398bbceee7b3a5045c2270b319ab7a948eec64fb06f0a3b66ce1f7954eb850c90107d30b37c871a7d5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738349, "uuid": "4c560a26-8309-4ed6-a2bd-7ab3cc8c7324", "value": "T103E2E1B4A7255870E0B00C37CDBF66A71D421A3DD1FA3A1719184799922B3CA7A39EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738349, "uuid": "38b1ce91-7a29-4786-9b26-d93184f51530", "value": "768:DL6y1JlHo+YXU1IxDqxNvkQC/oKfd2B9x16jNbJxnFg1s3UozM:Ph5uhDqvvkX/oKsduHDzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738349, "uuid": "f2677a90-59bf-48d9-bc1e-64c92ef6b7e6", "value": 32016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738349, "uuid": "80d88bc4-c481-49ff-a613-3dc691b7b089", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738349, "uuid": "f8df844c-a1c6-49fd-b9ff-d2a7fb897107", "value": "e0e5475bfb58e6a889f8a0659a85a79a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c48d84-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628776126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776126, "uuid": "6d7859c6-09af-4348-87bd-4fdfb9c4c22f", "comment": "Malware payload (Loki)", "value": "e086e5f7764c262bbb4d32fd18b06437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776126, "uuid": "d0a9c7ae-126c-48ba-8951-1b9335d38ac2", "comment": "Malware payload (Loki)", "value": "f23caf37ae944360657463d27df572d232fb5ef227d3ef753d1c6e6de80f12f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776126, "uuid": "91740583-22c0-4870-9267-90924916beb6", "comment": "Malware payload (Loki)", "value": "9ee5cc45e7f322404084fabffa85ad1edd9044dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776126, "uuid": "15e85e5d-b499-4a10-9e77-82d5cc776cca", "comment": "Malware payload (Loki)", "value": "94048b7277239a3ea2f3bebe89e525d3de4371a818d8beecd3dcf20d03d21220b89d217dfa276d204a996414ccadf00e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776126, "uuid": "f55f2f7f-3950-4d80-ba71-8e58ce2d7703", "value": "T14854F17076D6C031D8E2357944689CA29A7AFE310F7F92B723D6636A5F511C0CA38E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776126, "uuid": "2b8a2c0e-4d98-4307-b420-917b3ca3b4ec", "value": "70dc986f89100eba5b0fbf299e1d4ebf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776126, "uuid": "47897f4a-2235-4930-ab5f-0832a5b6c7ce", "value": "6144:bGl/lR8NG27aiSeL5e/ehT0KiH3CewMgTIxF250N2a9ciFfZ:bGl/lmGWaH2hAz3UM8+RFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776126, "uuid": "24165945-36b4-4989-8cd1-902f8cb4d759", "value": 305624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776126, "uuid": "3add0385-a83a-457d-aff8-699ffafddd64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776126, "uuid": "ee6e8fc0-1bfd-48da-98fb-6d12dd55e394", "value": "e086e5f7764c262bbb4d32fd18b06437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e832c209-fb73-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628776080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776080, "uuid": "c11e21b8-c360-4d60-98f6-658aeab3522f", "comment": "Malware payload (RemcosRAT)", "value": "4f905c7c9582971662d872ab1661b099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776080, "uuid": "da847d82-7394-4aa8-84f1-4ee6010b49cd", "comment": "Malware payload (RemcosRAT)", "value": "f2ca2d29d66a7ebdd2084d59ed559d0c2ff1a0d3d8ec99b93cf9a376708a3663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776080, "uuid": "a8ff4e0c-06dd-4421-a20d-1a0721403079", "comment": "Malware payload (RemcosRAT)", "value": "49efb4d57af7102ae83824d762a1e6b4e53e51ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776080, "uuid": "87a33fdd-2146-4a19-beb1-f8e136d7e3a3", "comment": "Malware payload (RemcosRAT)", "value": "d78d8e37ed544d6b5ab36048b18a86fd20e0567beff2d699386418da7eae0388d332d0a63baae3d9d88747a4ef47aed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776080, "uuid": "aeba7bd8-dcb4-43b8-8d95-3191d2413e4b", "value": "T114259E22F2917537C4672E7D5C9B5765E836BF042E9868892BFD2C4C8E3E2423875387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776080, "uuid": "31da71ce-d73d-40ee-85f2-cfaed1d24347", "value": "39334fad6fc37ecf56243de5802e190c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776080, "uuid": "bffcc3f4-7619-4ed9-b729-bdaeff810352", "value": "12288:lq1zaytHkdB6KK/2v7YNZIeT76kASvukn/rML9zpteqDaGuh9z:lqVayP/2TYNhaliD4eqDaG4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776080, "uuid": "eac3af90-4f10-4c83-ae4e-1f9ba788be33", "value": 965122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776080, "uuid": "6fe63471-c988-4cfe-8c3a-9e0dc6546884", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776080, "uuid": "8a4c731f-5c88-40d6-980c-36c2fe3afcc6", "value": "4f905c7c9582971662d872ab1661b099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf4618d-fb3d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628752546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628752546, "uuid": "54c02123-f84d-4296-ad6a-d291b8afd0e7", "comment": "Malware payload (RaccoonStealer)", "value": "72158068e858493966c0af1f5387ef3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628752546, "uuid": "85f6e726-089f-495b-a231-55444daf8c9f", "comment": "Malware payload (RaccoonStealer)", "value": "f430a7ce2df50c8e38d3f277a8a54b3c72470dc8ad78c21391e8f237072ad6de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628752546, "uuid": "aa4a5fa8-689f-4502-b43d-10654e9d6346", "comment": "Malware payload (RaccoonStealer)", "value": "cf57320a37b35275a9b5dd0fd3a52de3726d6136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628752546, "uuid": "b5af0e7b-6d85-45d4-aaef-1ab8890ff5fa", "comment": "Malware payload (RaccoonStealer)", "value": "6aca23cddcd565ae1ed5e9c806e7286ab89c789cbfac93d08f9098fe9918f917770c8666a657be3850776fe31fb59129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628752546, "uuid": "0a751dd6-b5c9-45f2-b240-3ada5593e54a", "value": "T1DC649D30BB90C034E5BB02F845B9937CA52C7EA1972450CF92E52AFE56346E5EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628752546, "uuid": "8a9cf1a0-a46c-4dd9-b1c6-023c00cedb48", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628752546, "uuid": "67a8b19f-9c02-4d6d-8b4b-bc790235c7d1", "value": "6144:ekRwtxxvZVcau/Yo1vwX7ttw+GcUJS1P2iiGraKFxPPSkm5w:ZwtnXcacXWX7ttKc+StTiD4xPPS3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628752546, "uuid": "12b1b1a2-ea6c-436b-a8b8-a9893772e8bf", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628752546, "uuid": "02473a3a-c75c-4f70-ad99-2e8e7428625c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628752546, "uuid": "03c43b0c-e39b-4c9d-a5ec-bbc2f87e88c1", "value": "72158068e858493966c0af1f5387ef3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd3cdcb-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767257, "uuid": "5c30e7d7-5544-46d7-9b17-905324bb0a95", "comment": "Malware payload (Nitro)", "value": "338f6dd5cf6e9def43fbab5f51d4c9b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767257, "uuid": "f4e2a5b0-42d0-4ae9-8a4d-3788f6ec5937", "comment": "Malware payload (Nitro)", "value": "f4b24d53d818a4caad2b050ed0db0b54d8235f59464227881b3aa4ab0b5a8799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767257, "uuid": "b1387fb4-5461-4f57-ade4-08a9983d0a37", "comment": "Malware payload (Nitro)", "value": "0c3bdcdd7df803326e2dfbfb81ece598ea2b806b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767257, "uuid": "654dc805-daea-471e-8edf-2ac88f93c387", "comment": "Malware payload (Nitro)", "value": "0861c574e3983c5a350d25b371eea20376526baf1db1128ca25556602415fa16ad1ea57a7472c4080e0028d163d5809f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767257, "uuid": "8cd4cc6e-ae60-420f-be64-ee2d5ae23778", "value": "T12974E9261962ED34C53C0C3017FE1A3997B0EEE9CEAC930D5760989C5FCB969DE62478", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767257, "uuid": "689cdfaa-d74a-4311-9a45-743c07ca7756", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767257, "uuid": "62185e8c-630c-4844-ba4c-13e6d0e775e0", "value": "6144:phfntKu069goiBLFHkF7R014qRljc+c3rO4mokQEFux2iZ:H0DoixmFVjOcERiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767257, "uuid": "acae3283-c351-432a-9855-bc36ce220a19", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767257, "uuid": "1ae9de23-1633-48be-bc3e-b14364db67f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767257, "uuid": "58a5f54f-0a14-4102-83b2-061375f0836a", "value": "338f6dd5cf6e9def43fbab5f51d4c9b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75978841-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766868, "uuid": "f7f55c52-9267-45e2-a420-506b55b01119", "comment": "Malware payload (Nitro)", "value": "04f273a042e83eebdc138f32a9547df5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766868, "uuid": "0bb48438-bf1d-4ba8-b5f1-89875d6a76d3", "comment": "Malware payload (Nitro)", "value": "f5097070861eef9727641d57a9be1ef130da95ba470b35946f25179788034762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766868, "uuid": "1fbe541a-ae78-4911-9ae7-a28a0e8b22d4", "comment": "Malware payload (Nitro)", "value": "2fa809ebd777b16647987cd89173cbd1cd007000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766868, "uuid": "6c1a378b-2b52-4159-97f0-ac5d1dbc0f06", "comment": "Malware payload (Nitro)", "value": "9bae2738f920a2dc14523215c95d9460864000aa7dc18ab5c48778fbf07b2e2facb233a4dbfeef9616f6bf6f330af70e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766868, "uuid": "30e26d7b-65c3-4bcd-8979-491bff594524", "value": "T1A153642852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766868, "uuid": "5e44d6de-77d3-4847-8593-6fd4f5b858e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766868, "uuid": "e236d338-b713-492c-9117-aa7573e9afc1", "value": "768:KKsMqCXfVcWpjDMLoiANIUcdYLDwUzc80gmq3oP/oDT:KKseVMLoiAPRr/0O8/oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766868, "uuid": "92f7680f-203a-463a-9afe-ea1df7a7a453", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766868, "uuid": "e126ddf5-4c0f-43af-94a8-e570ed962538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766868, "uuid": "a2314d8f-3e38-4b77-95ed-d2b74366ab6f", "value": "04f273a042e83eebdc138f32a9547df5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84726c67-fb6e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628773765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773765, "uuid": "6d43261e-f6a6-45e0-be13-411edf353086", "comment": "Malware payload (AgentTesla)", "value": "06a342da8fe87ea74a7b5c3e945212d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773765, "uuid": "5d2ed8d9-e0f5-4298-9885-b8a1b559c0d1", "comment": "Malware payload (AgentTesla)", "value": "f53b6d36630cd089f95cc2127cb9c564068512d6a4a4eaec1fe95e25f7f32d1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773765, "uuid": "4251906b-da8e-4862-a05b-535d51c38410", "comment": "Malware payload (AgentTesla)", "value": "01e94d38c651de33c1698da25717c05e837c1251", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628773765, "uuid": "1bdfbdfb-c569-4f39-b516-5e513a9cc5dc", "comment": "Malware payload (AgentTesla)", "value": "44955001a15d69ccf58f553052522e240a727853d17e0a94726909ec0ce9acd9e159638a8e777a81002b2a4b9ca63d31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773765, "uuid": "22f4ad81-6a8d-4ac4-825e-a89781f26246", "value": "T10365B33C29B9266FC066C675CBE59827F4009CAF3212BD55A4C73366473AA5379C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773765, "uuid": "4ea9f0be-6892-4469-9992-04cee7ceaef4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773765, "uuid": "9bda8466-5b81-41b5-8e4f-a653dc233713", "value": "12288:cSz96nx/5heyeqkiML46rZ7aT6qOLF4SijBU4uI1n+oT2fXJqWgSHRzjlM+DWLWO:cSx6zJV6rF/zLF1ijQINT2fX/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628773765, "uuid": "62e5be36-34e0-4099-9f01-2809464a89ea", "value": 1449472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628773765, "uuid": "4e5bf0b3-366e-447d-ba58-4bf851918626", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628773765, "uuid": "c81e42df-38be-450e-a07f-f25a74918b19", "value": "DHL_document11022020680908911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f310e383-fb31-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628747751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747751, "uuid": "aa7cfa5e-8fe5-4f7e-bb09-a11b5fa7c945", "comment": "Malware payload", "value": "aba2fc9406db4869e167bf61a7c76ae2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747751, "uuid": "6240d99e-d813-48ab-baae-24bdffc1691d", "comment": "Malware payload", "value": "f5d2b429bf603e18730ba3294317913e860d07de64586f9a48bca8680fd34780", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747751, "uuid": "6876b0f3-cf44-4442-91fa-e9836fee2872", "comment": "Malware payload", "value": "601d00c1ac1dc134e31ee56c7c92a4daf69d5033", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747751, "uuid": "cf883eb4-5c63-4989-9ffa-81f0dd4da1b0", "comment": "Malware payload", "value": "df70ccbf2914b0d7ef4d7f231d44f77f604352782873f750249454f3c46f29487824c46ef34cfce077a28553a70c3873", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747751, "uuid": "b104c8ad-145d-4629-a503-976525bab489", "value": "T18A43F17DE59DE29CC38AACFEE44910EAFC0A409653008B4B598CE74EEB20757C396D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747751, "uuid": "c6c174ff-56c0-4d3f-a861-24b018d689b8", "value": "1536:7WnkyoKFDgAyafdLjzZ8P27leSPET8RUDb:7WkIFdyaJ1sVS8IE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628747751, "uuid": "06e1356c-1087-46cf-99c0-1d1878cb4ec4", "value": 59872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628747751, "uuid": "b58d95d7-8b0c-4b66-8fff-bd4728175ddc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747751, "uuid": "0c44d48b-f1f6-4240-89a7-b80fc73353de", "value": "Whats_Wrong_With_Business_Ethics_-_2_CPE_Webinar_-_September_15_2021.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca20b98-fb2f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628746559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746559, "uuid": "1b168241-b158-4995-a682-561a7d5a1c33", "comment": "Malware payload (RaccoonStealer)", "value": "ac120268a26dc5241cc7339ca0cec629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746559, "uuid": "985e97a2-57f6-435e-bc29-74e4f3cc90c9", "comment": "Malware payload (RaccoonStealer)", "value": "f6d03959b3345bfab453faa15b8f615cccbec731e7c043a569dc3234eb1c565e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746559, "uuid": "8da335af-ae1a-43e2-9ab9-d4b43c3da327", "comment": "Malware payload (RaccoonStealer)", "value": "7a7086760c5917a3df43a3b1e0c0b97f23fb08b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746559, "uuid": "23c1d274-c027-43bf-84c2-e474dcd34381", "comment": "Malware payload (RaccoonStealer)", "value": "3a6845f3660fcdc1e55e68d8a8ee0b63aae596ea016f08d740bb4d5c96d011d5248ad7bbcd5c08b461884aa975c3738d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746559, "uuid": "9825f7c4-d594-4eab-a2cc-52813b9e3bed", "value": "T11A648E30BA90C035E5B602F845BA937CB52C7AA1573490CFA2E52AFE57346E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746559, "uuid": "f17dc96f-dab2-43d3-a8f9-741746e65364", "value": "ed992e9862dcdd605c4491d0f95bb1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746559, "uuid": "e11a62ca-9ce2-4a6b-ac17-30106441c0d0", "value": "6144:Q8sw9xbvZVlCmNwoev3X42HDcEucG/uYBNJNlNL2s9n5w:2w9pXlCW/2X42HDsc7QN99ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628746559, "uuid": "1020c76c-b7a0-4df2-be5e-dcae99554549", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628746559, "uuid": "4a0b09b9-b9df-4b46-ade2-6a6ce1c2ef50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746559, "uuid": "937b394b-7fa4-450f-ad38-540438379c66", "value": "ac120268a26dc5241cc7339ca0cec629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cb768a-fb74-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628776294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776294, "uuid": "b4d95ae6-7ac1-4a41-98f9-0d6c3ed7db24", "comment": "Malware payload", "value": "6c1b77a44bf111bd853c8b623d2f3334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776294, "uuid": "063f2e29-6d4b-4650-ad43-4bd12f0b8497", "comment": "Malware payload", "value": "f716105c9ddf6f05dd9b202e6a0a2064e0ca9a1021407fb1feee6f83512cac9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776294, "uuid": "92747d0c-10d3-400e-aa4d-0bf23e69b6e1", "comment": "Malware payload", "value": "659f1085b8f07e640afaf9fb925b431f096b668b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628776294, "uuid": "1cd9c1c7-7dac-4a18-b884-c08fa0f9bc71", "comment": "Malware payload", "value": "3397af29694b65d0ef6f12cfb3cd99b68e24170d8b8de3042c0958ba9c54649c9ca2e6340fb0e7eaec707c4940e37dba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776294, "uuid": "19984e14-951f-430a-8924-7a312187133a", "value": "T16404486339544D32C4030E37F0752A3BA697BC111514FF84B816FEA9E9F528C4BB7AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776294, "uuid": "2af24275-0c4f-4577-a147-14668e03d452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776294, "uuid": "7e1a35c8-ec5c-426f-bdeb-37aa873e2ae0", "value": "3072:0a+JamChofm5ghoMLfCffka8oXq7uxUEQJPlLGLabbbbbbbbbbbbbbbbPbbb3bw+:0ramuGfC3kzoXq7uxUZfMabbbbbbbbba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628776294, "uuid": "930740cd-4fb7-472d-8357-7c521bfc9871", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628776294, "uuid": "34151a7e-57d4-4d94-b697-b2f026dea230", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628776294, "uuid": "0feb8aa7-00cd-4d15-a5ef-85151e38b907", "value": "6c1b77a44bf111bd853c8b623d2f3334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b8cb1c-fb35-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628749237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749237, "uuid": "d039e3a6-73fe-4152-9eba-a8167010e184", "comment": "Malware payload (AgentTesla)", "value": "c4778cb347ee8573edc0ec44fb5aa36b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749237, "uuid": "4c1bdfa8-d5c4-4da2-834d-58ce58bb3173", "comment": "Malware payload (AgentTesla)", "value": "f770caf5a310284e4563d36a79ed4b3471844590d6acacf5c819ef63efa5b5e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749237, "uuid": "6d58a7db-bb3e-4d7b-b5ba-d5f670f1f680", "comment": "Malware payload (AgentTesla)", "value": "12a81052b2ceac35c8684861f0548a3a4df44bd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628749237, "uuid": "e3c49103-62c8-43c2-8080-5f26a481f645", "comment": "Malware payload (AgentTesla)", "value": "d8a4d98c6eebaa016ff32aee3fdd01d3841c4a02824afa39abd85a9486c7cc8305968ad28d070effa39c625d33656809", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749237, "uuid": "a2a867e0-00be-4a3a-ae5c-99dff90b8844", "value": "T13C053365D0D0DA328224C8E17554233C4A2D75ACA2381A8EE62FD53EF9537939B34F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749237, "uuid": "1d451c52-5ea0-43bc-9493-c9926474459b", "value": "12288:Q0OSFXMSyk6PO5AeHfUrct+1EgJCvACX7Dk+Io3sHRMwVqWJOKO+oeOkYtihyJFv:QmFXhKO+rv1LJDS7Dk+1cqT1wFZyJ7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628749237, "uuid": "aca01506-8967-4799-a29b-821e5a1acb6e", "value": 837323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628749237, "uuid": "b8bfde9b-ade2-4551-9711-24ee18a1bc77", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628749237, "uuid": "6eb471b0-eadc-4428-88cd-3eb6a95af6b2", "value": "INVOICE MALBROS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021380f0-fbc0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628808765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628808765, "uuid": "f4a9c01b-9bcb-4804-82f5-df3fbdda3bd5", "comment": "Malware payload", "value": "fe8953e299b378a06e2345d0ee75f710", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628808765, "uuid": "16192cee-b980-40b4-933e-2ed01272745e", "comment": "Malware payload", "value": "f847f5c6c64a33516e814a4bbc392ab3a8f0dc331bd24be7fa400bd753a7b20a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628808765, "uuid": "2037a711-b66f-4515-bbb3-02ae50eb0de3", "comment": "Malware payload", "value": "f76aaf0d3c2527088562c6c4b81ee8829ddafd17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628808765, "uuid": "a2f5278f-19bb-4102-9503-0bf5ae921a4d", "comment": "Malware payload", "value": "78a2ae1eec4d6220afee21de8c58cb6170e10fc157647f8587f3a53475d54d3214d80018cb1d68d8785b373330efb224", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628808765, "uuid": "511d1976-3892-45dc-a0de-a6071d44da77", "value": "T1BC65121379C58073D89617700C99FA210A3BFD811A759F17B74CB74E1B32EE2AA66327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628808765, "uuid": "a6feaeea-1089-45fd-b69a-d2da6251f4fb", "value": "e453b5fd6cb41875bd9963c4aad71d3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628808765, "uuid": "9f69ca94-6a00-4ffa-b289-8583ae749ef5", "value": "24576:FusF1d7wswVMxq8NTREEPQp4W+tzFDSZUfTR6eOU:FusFD90MhTREEIp4WQFDSsZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628808765, "uuid": "0aa6ae93-4234-4808-bc2e-bbfd8fd93abf", "value": 1475560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628808765, "uuid": "1ea213a4-de05-4cc1-9ccf-0358011a770b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628808765, "uuid": "a99d886c-97e6-40b7-ac9b-497b0f675f35", "value": "fe8953e299b378a06e2345d0ee75f710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cc3291-fb2f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1628746898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746898, "uuid": "2c2d5acc-5dee-467d-9f7d-2eae3319a475", "comment": "Malware payload (RevCodeRAT)", "value": "f929c9ea28ed89d0db312df5a284545c", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746898, "uuid": "e73a4646-0fd9-44a5-82b1-6387806eb425", "comment": "Malware payload (RevCodeRAT)", "value": "f85ef46438b8f65621b8ffeee02aaa1dd95b00e04a370f12977f52051749102d", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746898, "uuid": "1091ac7c-4a1e-4e15-9982-830847131380", "comment": "Malware payload (RevCodeRAT)", "value": "50aa921431f32e6378b855eb7153eb4e311a52d1", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628746898, "uuid": "9a54f050-ed8a-4f93-b0c9-ae2a87c29f35", "comment": "Malware payload (RevCodeRAT)", "value": "93f4d63149b33a18c894c1af515ec4edb748fd62dae7c6de4f12a8f26ed60df8c7315cc69e6624b92db5201dc3e68d15", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746898, "uuid": "33c02b38-0717-4062-9a7c-13c4532087da", "value": "T18D05333E6CDBB1DC1AF945F842A1EB750263B8EB5F5DA91C0C272A9EA43197F3463110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746898, "uuid": "f176559f-d6b3-4014-9616-e4d275a9c197", "value": "24576:66LW+AyqCBjA7wDLK12xY4ymLoYEPTagy:8/yq8hLK14QdPTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628746898, "uuid": "8fb4bc17-873c-4de8-8d17-9af1afa82bf5", "value": 795635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628746898, "uuid": "77b4ed26-3ef0-4944-97dc-d76338cb3ab4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628746898, "uuid": "0d5c12ad-67ad-4ea3-9e78-00c10f1bb7d4", "value": "NEW PURCHASE ORDER.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fd6558-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766947, "uuid": "3b4a9c20-561a-405a-83cd-8a96ae5d258f", "comment": "Malware payload (Nitro)", "value": "5a615891fcc57b57e9deffce6f559947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766947, "uuid": "0db9df48-97a8-471f-89c9-015a95c7e9fe", "comment": "Malware payload (Nitro)", "value": "f87348b4072f019791377ceb26acea2c19c5e8b317424ec5592eaac8ace7bc52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766947, "uuid": "12e6a80d-179a-482a-9511-1daf0127b208", "comment": "Malware payload (Nitro)", "value": "47dcdac5e7ae5d8f8a625471a0070e6c7a53d4ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766947, "uuid": "59746868-fcc0-41c0-bda8-341f2175bf33", "comment": "Malware payload (Nitro)", "value": "33c942242aa781f796a4a4bfa5350be41cb9169e15ae4b7066adeedebacc131f696770f8e84fb259bdf913ffa8be7c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766947, "uuid": "82f30f07-3fd1-4bfd-bec2-b8afde8e0cba", "value": "T1FC53532852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766947, "uuid": "7a502ee8-d6cb-4c2c-89c4-e91a5f25e05a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766947, "uuid": "e0e25666-a25e-49c9-8faf-a57969d81bf8", "value": "768:KKsMqCXfVcWmbM9ZkiANIUjBcYLDwUzc80gmq3oP/oDP:KKseOM9ZkiAPTr/0O8/o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766947, "uuid": "43b25558-0f8e-436e-bf0d-bd01047d9c4b", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766947, "uuid": "295fa55e-cc16-4a1f-bed9-ee46cd9d81bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766947, "uuid": "0ced1a9b-c3e9-4959-8e3f-5fdbb93ab94c", "value": "5a615891fcc57b57e9deffce6f559947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e05259-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767323, "uuid": "2a248819-c644-4975-9254-65d8d56bc1d9", "comment": "Malware payload (Nitro)", "value": "8910b2027972c981e85da40f9869b5c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767323, "uuid": "dac21114-f841-4004-b5f0-638a2f9a739b", "comment": "Malware payload (Nitro)", "value": "fa2c56fde9e9006a859c409ed90594d4422bebf9eccc64fd70ac296eea2e47ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767323, "uuid": "268d29b4-e75e-471f-8846-9bea98006a46", "comment": "Malware payload (Nitro)", "value": "db400e592c40874f66a12b19d8e5a04ec3edf424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767323, "uuid": "8c89e617-c728-412e-bda5-dd792138d0f3", "comment": "Malware payload (Nitro)", "value": "b54773e19acfb6f4d872822081029997a3da5b721a4b8c9a5bad8f63846930f606bcdc0338858bb17f7d61a08ca793af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767323, "uuid": "9deed1de-79d4-44d5-8844-1e0cef51803e", "value": "T16253542852738A2DC47C82B815FB2F7C27B0AF566460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767323, "uuid": "37052f78-ee79-4085-93ea-9ba8e569e84f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767323, "uuid": "c401fb67-db44-41f7-8fe1-2950df189827", "value": "768:TKsMqCXfVcWeHM9ZkiANIU/jYLDwUzc80gmq3oP/oDv:TKseKM9ZkiAP0r/0O8/oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767323, "uuid": "f5127674-33b7-4e27-9f27-decff4faca4e", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767323, "uuid": "527d29f2-6925-42f7-a797-073ae15beed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767323, "uuid": "32141827-027b-4f0c-b683-a94cd8e49cac", "value": "8910b2027972c981e85da40f9869b5c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a918fda-fb29-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628744086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744086, "uuid": "d61a3b2e-6f62-4788-a399-e46cecf5bad4", "comment": "Malware payload (Nitro)", "value": "befad918d88f92f7bf5532794dff5d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744086, "uuid": "76be3512-a6fc-4b30-8dc8-f9f1bb891b67", "comment": "Malware payload (Nitro)", "value": "fa354e28c5325fb189cae24b88354674476ce1ab764dc94c9fa6178dc7d2314a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744086, "uuid": "2af10b7e-a200-479b-9861-e56da1017ba8", "comment": "Malware payload (Nitro)", "value": "3f9e1fb8646b98df4e3992fde1dfcfe90f6c4592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628744086, "uuid": "cac04bed-5b3b-4d05-8d38-26362b6de66e", "comment": "Malware payload (Nitro)", "value": "4322c2e383d4211fcf25dcea7d7accf75d93abff97c99b75c7eb40bbc48d27aa90d58383b7fae1b0a20b1878b6f5fde3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744086, "uuid": "893d0ca0-3aa3-4b78-a5e4-df26aed0769b", "value": "T1B853542852738A2DC47C82B815FB2F7C27B0AF565460C75D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744086, "uuid": "68b08d9a-028a-42f5-95ec-1abf0ff9a25a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744086, "uuid": "53af9591-dc6f-4838-8ab4-20fdce93a53b", "value": "768:IKsMqCXfVcWfLM9ZkiANIUXqnYLDwUzc80gmq3oP/oD3:IKsejM9ZkiAPxr/0O8/ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628744086, "uuid": "ecd47858-4b0a-4e23-9f69-3bd65fde338f", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628744086, "uuid": "547c3028-025c-4cf7-b1c4-2afe4d02e1dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628744086, "uuid": "76703538-d96b-4785-a4da-f3cdd6d905d4", "value": "fa354e28c5325fb189cae24b88354674476ce1ab764dc94c9fa6178dc7d2314a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd79c7f-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628737995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737995, "uuid": "171c371a-4d11-4e7c-80b5-79bce855aca9", "comment": "Malware payload (Mirai)", "value": "36f7152803eaff478b72709d300cb1cc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737995, "uuid": "7983f5c1-938e-4cfd-bf25-52454b1628c3", "comment": "Malware payload (Mirai)", "value": "fa533054ab117b02884bd215c00960e1e7b614b31aa06f2b435636eeec785bc1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737995, "uuid": "8e2592be-3ab8-4651-a111-98267dcfea1c", "comment": "Malware payload (Mirai)", "value": "427817ef26c9dad803025d24c9baffb7ea1e60e1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628737995, "uuid": "c758642c-5364-4dc0-9bed-be650ac249ac", "comment": "Malware payload (Mirai)", "value": "70b828c8a768b3b2c43b4a0b75c3f12860680d0b8722d898aef7d2b445268eafa0c18af67c3497572884702d25a6d755", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737995, "uuid": "f60b4fff-2929-4ac2-b9e9-aa8de42dfe0e", "value": "T1FAB36C176692C5FAC08342B92BDFA1618823F6790B36331773D5BDA43F158CA6E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737995, "uuid": "a165ae11-def6-46f3-ae08-6cb2450ae090", "value": "3072:Zt2nlia9qRBFZm4z1EYfcbJwphawfuJv03CKPCNVOXinYuM8R:MsVm4z6Yg6phasqcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628737995, "uuid": "33d62822-d1dd-4ef6-8b2b-8294a804b92d", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628737995, "uuid": "a52971d8-9061-4830-832d-07aed6c4a391", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628737995, "uuid": "cd321303-6a05-4e88-9b54-7081443c0d05", "value": "36f7152803eaff478b72709d300cb1cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b98198-fb33-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628748213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748213, "uuid": "ab0f996b-8a5f-4d52-b96b-433404fc8ab4", "comment": "Malware payload", "value": "c2dce61e2cf0aa401723a8d3748a391e", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748213, "uuid": "592f924e-182b-40ad-9bc7-787d71027f5d", "comment": "Malware payload", "value": "fa836241791451457afa9d8daa655a39c3e07804ca3430b94a7664467717276d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748213, "uuid": "7470db64-290f-4f6c-8893-e48989e2f66c", "comment": "Malware payload", "value": "6d4b76243f89d1d0363af7fb1c8752cd2982e321", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628748213, "uuid": "d8308eb1-6e45-4996-b1de-b6c25f58568c", "comment": "Malware payload", "value": "f3757d99272bafc400e00c4341c4680635c091e619cc5abf5d8425513d52f3a54a62c8fe9e7fc2055166dc2f1a1429d4", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748213, "uuid": "d97dc39c-b0df-4e56-b9dc-f80aa329450b", "value": "T1B707333A22D72026FF07557147DE0A4CC827DD7F71187972A8C2E768E29B429D6AB10F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748213, "uuid": "d25a6b46-1edc-48da-9543-0c7eb32646c5", "value": "393216:NjgSaAIzEkHwC90XXTjvWjfGOEmcRNnmilX7DS0x:l7BqU7HTjeyjNm67DS0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628748213, "uuid": "20c13455-49b4-45ee-9162-011c3d802a03", "value": 17985751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628748213, "uuid": "fb23a67e-0a8a-4a6a-bf47-d938172c7b4c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628748213, "uuid": "1616f3c8-3b47-4d3b-9daf-7dfe720fb832", "value": "crl_currirulum.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f8327c-fb1b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628738003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738003, "uuid": "4c1e35e3-2aa9-4c8e-a9d1-4f9f2bb4c6a1", "comment": "Malware payload (Gafgyt)", "value": "b5c34e18208b543c93e7f2aac86746fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738003, "uuid": "8e1dd5c5-74b1-4467-946a-a55eceaa6db1", "comment": "Malware payload (Gafgyt)", "value": "faef9fc9a9e65fbaf1a95c741bc0c9e10fce8757e3ed0414680f4a9d20d22570", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738003, "uuid": "a0638847-46e4-4182-b80c-4f076962a037", "comment": "Malware payload (Gafgyt)", "value": "06748301dac9fd61f403bda2b0bcd048aee4b776", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628738003, "uuid": "e132e2d5-71a4-4a8e-84a2-2deda5aed828", "comment": "Malware payload (Gafgyt)", "value": "33b32d2a9381f7f77d2078a338cb6e4fa8e2ba48f4ae0906283e1fc4809d7be07f08dff1b16cc1f25c4b6971ed6c1346", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738003, "uuid": "0de381f7-2987-4e68-a935-a71b10feeae6", "value": "T111B3842A7E22EFFFE668863107F35F7087D5219226A19385F26CE6181E7128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738003, "uuid": "990334c0-9ee9-409b-8f7a-38bdc3e5dc78", "value": "1536:27ju1Thpq+XvYC2rKy3eY5PGEEeRYYID8vECRIKmbaUmkiSFxfC7xbXe:RvYJPGEu/DF8IKmuUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628738003, "uuid": "53cfaf26-a96f-4d0b-ac21-f9d71286d94a", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628738003, "uuid": "a9e39c54-5d25-4201-84dd-324f627aebb6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628738003, "uuid": "1f38d7e6-ecad-4d6f-b9c7-759d29e4fc8a", "value": "b5c34e18208b543c93e7f2aac86746fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb6fedb-fb46-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628756651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756651, "uuid": "a2945cb2-7953-4ea3-acd6-2d2afc950921", "comment": "Malware payload (AZORult)", "value": "9192c2363847689ba2d28c05c4c04c6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756651, "uuid": "7411e0be-6132-4ea3-9f92-d28f8b3dd90a", "comment": "Malware payload (AZORult)", "value": "fb64982d0bee9d86ecd9ddca94b51091f146f2c77ac622c4b4c9908080ed7324", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756651, "uuid": "c52c3e35-33cf-4a25-a441-54873863d735", "comment": "Malware payload (AZORult)", "value": "b3f174d14b24967a0d95b293731ec013d9831e91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628756651, "uuid": "221cb898-b12c-414c-9df6-861ff39cf310", "comment": "Malware payload (AZORult)", "value": "a69e66a7f15fd10b816af258f293b827e0eefc48064c6171b8e0c0975d7e52f981f8041d3879d9e05e07d3a9ba4b2d03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756651, "uuid": "5f0ef051-7c2b-437d-950f-0cdf3eda1f65", "value": "T1D1E46B3B23D96BFECA7496F9141190938AE28D056826D61F3CFCF5CD08246250B7D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756651, "uuid": "0a4a4df0-6381-428f-ac61-d08b0e5c0312", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756651, "uuid": "8353fe0a-aea5-4b3e-a8ab-d14ac15f5b29", "value": "6144:QaW9qkTX/Q6SZ70111uX5KNYGo0KyDsZuRczFcut7BKzFCY1A/QrmsblRZQT2cV:QaW9qMX/TzuXCzXDUO8ptgzMYTmsbHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628756651, "uuid": "00cd4ab7-25ad-4531-ad01-b75fb458fe98", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628756651, "uuid": "68a44a74-34b0-4759-9919-d71e642990b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628756651, "uuid": "909dc676-e60e-41f4-8aed-237d96a71949", "value": "9192c2363847689ba2d28c05c4c04c6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8bff15-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767415, "uuid": "2d3ffda0-0cb2-42de-84d4-a43550ddad32", "comment": "Malware payload (Nitro)", "value": "682723a522c86f64b397afcdd65c21a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767415, "uuid": "59d5234c-1c48-4cff-b54d-755a03e862c7", "comment": "Malware payload (Nitro)", "value": "fb92c528c1207a2421ec817cbf9793a3859637d7dc235a3998e07695860e3ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767415, "uuid": "25d47b62-600b-405c-8a67-452cb4bca0ed", "comment": "Malware payload (Nitro)", "value": "80999ff4ac0b068eb5028b50601b7ec9fe77a827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767415, "uuid": "1b7dbad3-60b4-48a9-bd56-320571dd28a7", "comment": "Malware payload (Nitro)", "value": "fc1f54ab0ac4e68f6f415295fc626cf13cb5cb13844d35cfd284b3b0e5678e811f19516a7789c8966a6f8a156cc0bce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767415, "uuid": "b01ce0cb-b96a-48bf-95bc-67befcfa734a", "value": "T16453542852738A2DC47C82B815FB2F7C27B0AF565460C76D4A78D2AC3F277B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767415, "uuid": "389be6c6-46f6-42ef-bd98-ae2158ea88b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767415, "uuid": "84307a8a-1a3a-43c6-9d63-2043060dca91", "value": "768:VHKsMqCXfVcWlQM9ZkiANIULAYLDwUzc80gmq3oP/oDw:hKseSM9ZkiAP1r/0O8/os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767415, "uuid": "175e0a74-2ddc-4239-b216-5b69092b4f5a", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767415, "uuid": "a4f05bfe-edc2-48ad-b523-3453757667c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767415, "uuid": "ef8dd1e3-ed56-42cb-8287-45d6203d2868", "value": "682723a522c86f64b397afcdd65c21a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42c7e46-fb5e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628766973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766973, "uuid": "17e75973-1462-4455-8be0-9b4034555a5f", "comment": "Malware payload (Nitro)", "value": "8bf1c633b4e20c6896a3fd307a840245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766973, "uuid": "b1338632-fac8-4108-b05c-00b9c778ec92", "comment": "Malware payload (Nitro)", "value": "fb9babb3bd29a77738bb4e4f37394992be0add9521ef64adece1845ea479313c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766973, "uuid": "98b84f3d-8056-4a71-8178-e163af7fd46b", "comment": "Malware payload (Nitro)", "value": "20e579b22ca06c0509fbc194888bad168d5adb0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628766973, "uuid": "2c3629ec-a82e-4154-84c6-f79d2911aa68", "comment": "Malware payload (Nitro)", "value": "cde2e56c160901f8667c5a5f6eac34fb579d491902810d2d758590907fca23e567d2339f7ff4ae9dbc4ad20e33fd002e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766973, "uuid": "c46a399f-b72e-46b1-885a-15bdf5c24151", "value": "T1335363246173882DC87C857815FB2FBC1BB0AF166460C7AD4978E26C3F677B68D20B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766973, "uuid": "d737d664-972e-4bd1-ae2d-5d6d760f196d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766973, "uuid": "79d6efeb-7343-4aee-b12c-107c9363955e", "value": "768:YP+2AG1MXq9E3tnJvLDwUzc80gmq3oP/oDS:Vz819EJhr/0O8/o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628766973, "uuid": "12edbdb6-5493-4b6c-a998-7687fa248593", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628766973, "uuid": "79e23041-428d-45f7-a716-565d2ea76030", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628766973, "uuid": "c65f5b28-a32f-4c11-8cb4-120a9358faed", "value": "8bf1c633b4e20c6896a3fd307a840245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b6abde-fb39-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628750849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750849, "uuid": "c5ccdea2-45b8-422b-8d89-4f50ee4b7de0", "comment": "Malware payload (AgentTesla)", "value": "77f00068ee473047ad38b9c4b4d1c70c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750849, "uuid": "357a56e4-ff2c-47d7-a9ee-901ed1bfc057", "comment": "Malware payload (AgentTesla)", "value": "fd005a9e1338ec61c37128a4726b568fa8815a2a2bef52e7d0cca3fed9b69be8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750849, "uuid": "bb6882b6-c616-415b-b836-aa400df12d98", "comment": "Malware payload (AgentTesla)", "value": "05a68472d69ad3e97896543511157837decca3bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750849, "uuid": "af8c8f1a-0949-4f29-af1f-94358c03bf70", "comment": "Malware payload (AgentTesla)", "value": "d230daa088f714430060d74f9d09f5bfb0d717d0f350f1b274f17b45c4d9c858994c73c670ee1f84480a29b7b9737a00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750849, "uuid": "1dd5f4f0-7d2c-418a-b455-4ef5833d5b64", "value": "T16705CF9C769076DFD817DA72CEA42C60EA61B47B871BC247901305ADDE0E99BCF106F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750849, "uuid": "bf13a6ae-5219-4bfb-80d0-7da84599a7b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750849, "uuid": "a767e594-58ef-4b6a-b818-82ba15efa5c5", "value": "12288:oDCHK/HK7zL2gdfnd2adIeTtDjdRIu7+DsL7SA8WxLifhm+A+mb8fX1sWJmQ3axc:oDUPv7TDjdRX+QV3LVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750849, "uuid": "ef7318b2-36c0-41fb-b85b-1e04c63509c1", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750849, "uuid": "f0f34033-38b7-4fbf-8f17-38e652ebe805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750849, "uuid": "653fe8e4-a1c5-4d30-8161-92b3700acb76", "value": "Invoice No 0112021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073468b8-fb58-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628764106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628764106, "uuid": "3c07d7f0-d861-4e2b-a0b9-b8543ce7ced1", "comment": "Malware payload (Formbook)", "value": "638b6ebd151367c3edb3c71446f69dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628764106, "uuid": "bb87cdd2-9df4-43e9-b452-233225867fdb", "comment": "Malware payload (Formbook)", "value": "fd151f1c914b41e565c1dfeae2cab5c77fdcc885b83c46e30b9fe3eefc68efd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628764106, "uuid": "b16130fc-0f9e-4760-a5f8-8ff161489cd3", "comment": "Malware payload (Formbook)", "value": "940e938809b6cef36948df102cb4304969c2f58a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628764106, "uuid": "cc658bfe-802b-432a-b705-e1aacf196263", "comment": "Malware payload (Formbook)", "value": "9a116f316b99d03e24919b04667ddea25b358822459171d0f77464bba68a6d4e6149819692fa483b22614f0f3c15df32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628764106, "uuid": "f7443f6c-16a6-4fb3-bb7f-61943c37e63d", "value": "T16005C09D36A072DFD817DA72CEA42C60EBA1B4BB871BC207905311AD9E0E957CF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628764106, "uuid": "05a58333-69bd-4ba8-88c8-69b25a7dd422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628764106, "uuid": "c9d86489-e615-41da-b275-41f7f0e99f74", "value": "12288:G49Q4FR9/HK7zPxQ9l2hZQ9ixuWFECiUnQ5np6m2s94pcwwsqO9gAAu8WP3YxAEq:9JFuNG2hHuwkUQ2m2s9qNqOfgW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628764106, "uuid": "297e2d6b-5b89-4c1d-965f-f59db83190f8", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628764106, "uuid": "9f4fc55e-97d2-4083-a6aa-42bd08fda543", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628764106, "uuid": "bd5a6558-0ea0-4bf2-b15f-a7a8205ceb4e", "value": "DHL Shipment Notification REF 08122021.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de7dffd-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Nitro)", "timestamp": 1628767231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767231, "uuid": "16e56e0d-b3b1-4a34-bfcf-ba27aee01a6c", "comment": "Malware payload (Nitro)", "value": "97a6a6eb35fbd7f8f6752c42cff2d358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767231, "uuid": "c1041b71-dd84-4d34-8311-7f4b79eced3f", "comment": "Malware payload (Nitro)", "value": "fd59987622ce4821e366b8d6b689c982d34ad8bb8e77e9674ad0b655b2768e82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767231, "uuid": "d14e1fa9-51d2-4d2f-92cc-a8cb326eedb7", "comment": "Malware payload (Nitro)", "value": "c9ebb02c234804a64f4dccfeaa26dae39afc9a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767231, "uuid": "8a7e2122-3a0c-455f-bf6c-e79fe28ee753", "comment": "Malware payload (Nitro)", "value": "1cc151279332f5a55b6f4d280765386f92f982a9a6ea8a67c03248b14bb38036514a4ac65fc53a766b77b8743e4b69be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitro", "colour": "#CC9204", "exportable": true, "hide_tag": false }, { "name": "NitroRansomware", "colour": "#56CF57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767231, "uuid": "cfc63079-ed0b-453f-a12b-d674614f9a2f", "value": "T1785365286273842EC57C81B811FB2F7C2BB0AF556460C7AD4A78D26C3F677B68D10B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767231, "uuid": "ae023e21-a3e9-4334-8c3c-ac64381941cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767231, "uuid": "a9b27c81-c49d-46b0-9888-93aaba1ae5e8", "value": "768:nOucKn7n1J2ZDNANIUf5vLDwUzc80gmq3oP/oDk:nO22ZDNAPJr/0O8/oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767231, "uuid": "78673e2c-3c73-40ff-ab4c-253e2c956548", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767231, "uuid": "36c3b148-cbdb-4a14-9a48-e44bf214f6f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767231, "uuid": "f8bc9375-d62a-4cd9-bb82-08a0c2dd5b7d", "value": "97a6a6eb35fbd7f8f6752c42cff2d358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c2ad34-fb5f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628767217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767217, "uuid": "5cfc946b-4061-4e65-ab90-4042c6b7b5c2", "comment": "Malware payload", "value": "378b5331c2d94bb7907bc70b8f97cbec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767217, "uuid": "a8eaca61-e11a-4011-8589-50ca1ca3dc91", "comment": "Malware payload", "value": "ff0d60cdc768a7f3262304b27f22a9baebc8348b21cac75b85e9d59a845e5b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767217, "uuid": "c68c0e1c-2a9f-4470-8dba-cb9acb099a95", "comment": "Malware payload", "value": "1944ae8a089f20be5ae512e40a5deb4c3a6ad5b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628767217, "uuid": "3efc308e-ea5b-4095-9a9c-5dc9b3e7067e", "comment": "Malware payload", "value": "8c749590efc2eba1484082c0be6b09c91dcb86ce6bca2e31b9421444eac9b0d6c4771751e47780de7a9f9e2b9e239593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767217, "uuid": "90858c5e-d008-4b5e-b28e-6e5cb8b0120b", "value": "T12D75FD2A657FC025C1E7EA712DCC64BADA7998A3510E713320AC637F4B52784DE0F1B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767217, "uuid": "ae644d96-ee91-45f2-a970-d443b1f51799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767217, "uuid": "ef70a659-854c-42cc-ba55-547848a946d5", "value": "12288:cF2hrazesEAFkphsR1GdSzE2Jlr6k0BKY4sxJ6Bwo3jRL:gEAFJ1CR6zRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628767217, "uuid": "b105477a-0d43-4a76-aafa-3c687246789f", "value": 1648703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628767217, "uuid": "7aeed71c-c475-4c07-953b-eb58880a29df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628767217, "uuid": "7efedd57-3fa1-4e32-b813-4596ac9dac71", "value": "CSGO FREEHACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7269d0d-fb27-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1628743355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743355, "uuid": "6d9eff4b-5634-46d2-a440-389e5d78f4ee", "comment": "Malware payload (Amadey)", "value": "b2798da0d2f45f4141ca0a2da25b9022", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743355, "uuid": "b07fb3f8-9ca8-4b5f-a981-d9d442d5eb37", "comment": "Malware payload (Amadey)", "value": "ff0fc799639c097a80c46f92afb2a3a1d24743eea8ddf25dc1f5270d3c877279", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743355, "uuid": "7b2912b5-d274-4ad1-ae38-95b26acedee0", "comment": "Malware payload (Amadey)", "value": "18acdfec7196d99ea6988bcf81be37a39d188d91", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628743355, "uuid": "567e846e-585c-4031-903b-ea08a603af3d", "comment": "Malware payload (Amadey)", "value": "d713a2cf19d03fb07030c542ab4959b17f5b4c4c55d0d2b23bf3cc7b7507322e50b3ef4e538a13179d9cdd496b887234", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743355, "uuid": "aae0d2b7-bd54-4112-8b5a-6d876e742fb5", "value": "T17064D0313690F832EB57953074EDC7A5FBE9AD20675152472B983F2D2E33290276B34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743355, "uuid": "20a9fbc9-cdf6-4450-9958-09ec2641390e", "value": "e167d9e0823b3034f406b282c3e2b91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743355, "uuid": "b7dc24d8-0b72-4a1e-a413-263b51b50557", "value": "6144:8sMGYTs4bqnuhi/9QHoU30JrKpvWWCIwIKMQ:/MGYgWquhilQIU3wuV9C5cQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628743355, "uuid": "6babbfbf-0221-4a6c-96c5-5659145b9847", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628743355, "uuid": "48c7850c-e3fd-4180-bcfe-217a6040c9b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628743355, "uuid": "b35eeb1b-8fed-48bc-a019-b78421fb8a72", "value": "b2798da0d2f45f4141ca0a2da25b9022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c5251a-fb31-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628747378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747378, "uuid": "d63d510e-e65d-4d94-81d0-ccf3a25d6645", "comment": "Malware payload (Formbook)", "value": "56bb9a9db5f392d8c7614ab4b3537951", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747378, "uuid": "7a80bc4f-a3a8-42d8-b8e7-c7047fbda799", "comment": "Malware payload (Formbook)", "value": "ff233af2187a5aee8d3911360eef243367c505348b896473cadb76e077d44646", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747378, "uuid": "b66b32c6-0f74-47ad-b412-f929c3d3392c", "comment": "Malware payload (Formbook)", "value": "3e5e31e1f8c37d74369ac09cdb0a1054c4804474", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628747378, "uuid": "aa369b86-24f2-41b6-bec6-94d8aacc971a", "comment": "Malware payload (Formbook)", "value": "4923bf8a81eddbd81e48e0721efd137a1349aeeedd13a5cdd9cd0d53dfff02110f41b33bac63142dd360b46b4a326f67", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747378, "uuid": "509174f6-c1c8-4c51-a130-a26b5ffa07ea", "value": "T1138423E166EE4CABC784987A1F7F6385410015FE2E1ED663977886E08E2F472623F560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747378, "uuid": "68d3ba6d-affc-4e2b-8c10-f05dc6ab20fc", "value": "6144:DKmZVEKtFCy01S1uHWNF72Osooq86PO05GmmW05KZoDdEMm/dYqG/5k5cqvcbfpd:DHZVVFSWuHwyOs2wh5moDd1Y+Y6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628747378, "uuid": "4e77a988-09e9-4680-9305-6b7a0d179a60", "value": 399971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628747378, "uuid": "b697e752-3984-4e91-b572-59256a0a4193", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628747378, "uuid": "fd111f20-3fc1-42df-b8af-3ccd178d3cdd", "value": "bnh.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563d9b1f-fb6a-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628771969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771969, "uuid": "e5a7b6fe-5771-4cb3-b6ab-8d62082419e6", "comment": "Malware payload", "value": "eb5831a16b1b2528a343c033c5e41116", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771969, "uuid": "a944a47d-72f3-4998-9f2c-7b9d3ace7711", "comment": "Malware payload", "value": "ff432f1ae8e63a95f30d42116193e7c4d4a299a341661e3924ef0beb163bd3fe", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771969, "uuid": "0cfbeef0-1acb-4a1b-90ef-30431c646a84", "comment": "Malware payload", "value": "84bc0a3208fd7997dd3c428734f75cfbf8425679", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628771969, "uuid": "0d95bd63-e6ef-49c8-8c33-ec4f8bf38caf", "comment": "Malware payload", "value": "6bff14536822deb55e87c8066c8b9504a45c412b4bce3d8b0cef0141434eb5588cdf6fc083784781bb859e353a6d0ce3", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771969, "uuid": "ec0c498b-2c70-45d9-b1e8-8e043a86d21b", "value": "T1FFE312EE9F18685DA1D9AD903771D710648E659FEA00EE0078FC4CDFDAF0D00AA431A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771969, "uuid": "d203a7fd-f255-49a3-912b-e8cb00a5dbb6", "value": "3072:rZ97hhgwQsR3JXsiY/QUJkX04WSt4xB1Y48V5cwFX9Qj:dXi+l78kE4LKBUcwFXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628771969, "uuid": "39ac8091-8f40-43f9-ba89-175f2913c4d0", "value": 155918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628771969, "uuid": "53929fb2-0cc6-4b89-b6c8-0173b2feff61", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628771969, "uuid": "b79f55ad-9680-4587-9fd2-3b38177b6b46", "value": "Bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b356433-fb38-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628750422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750422, "uuid": "74dffe64-07d7-4d05-b980-fdcaaa859fbf", "comment": "Malware payload (RedLineStealer)", "value": "20e704d3e137459c78beafbbc85a3a1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750422, "uuid": "7ac7a8d4-1568-4520-a003-e92cfb3914de", "comment": "Malware payload (RedLineStealer)", "value": "ff721387c09c52da9e700f8c45a576b3bb23fd9235de81ebc5259793ac643eef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750422, "uuid": "d9616ab6-edae-451b-abdf-9b77c5e3dc10", "comment": "Malware payload (RedLineStealer)", "value": "0a629b6d207ec4c80207320379369bb83b09893d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628750422, "uuid": "13ac168b-ad87-427a-896f-c8549f01e757", "comment": "Malware payload (RedLineStealer)", "value": "bafb848c56392d7bf7a72ffcbdba28b47bfa5b9aacf7029b70f140daef16a9d94ab5b102fb9cacba61be8aa2f5fd5ee7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750422, "uuid": "3f1e224c-34b6-4552-80cd-707eb948680c", "value": "T109D5121D2D81CEDEE2C45E37A387E11841B65F22DB2BCFCE56C833E959752A09B066C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750422, "uuid": "dc073eb8-9141-473e-9221-0fc5789e0598", "value": "5cdfba68edbb115e7aa5ed6776bb6546", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750422, "uuid": "169f259f-0c33-425f-b492-77fd2efbcb99", "value": "49152:tVCnOFEGRdoPciiJZFLEl4tnrh6GcbxwDaABntrHBKDyCh/pPZSiS7DXj5V:tVcOffmcitqr/cbxunt8DyCh/pPODXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628750422, "uuid": "d22783ec-cfde-44cd-b30e-eb9c89f1b790", "value": 2811412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628750422, "uuid": "52efec89-161a-4bff-b8a1-f4ab26f9c02d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628750422, "uuid": "eb21c852-e212-436c-ac31-a5e0f75f48a7", "value": "20e704d3e137459c78beafbbc85a3a1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3742663a-fb94-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628789956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789956, "uuid": "82b31d71-75f9-44b2-bdb7-3660fa999c40", "comment": "Malware payload", "value": "c47abe4e022b15971aee17f80f117912", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789956, "uuid": "ae26d7c7-4999-46f4-8ca1-8bd4b6368825", "comment": "Malware payload", "value": "ffe85dbc910b8c3f2487a94bab92fa964341d06b04144d7e385fa60c3836ad29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789956, "uuid": "c327f656-5105-4c46-81d1-cda2d27527b5", "comment": "Malware payload", "value": "71bbe7aec771eed591066b39db72b7d700fc0488", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628789956, "uuid": "08c894b1-2b9c-4d0d-a552-25257d959ee5", "comment": "Malware payload", "value": "e1822df86ab551859400e298130a40f6cdb699afeae6be41ae8f1b92d1419f0ec021146e2a295a355b5d56a47f063f90", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789956, "uuid": "9a01dd25-6f2c-49a1-a31c-35b101fa0d21", "value": "T161A13B49DE44708493A993676E7EF5018E7EC86700DEC8E5FB40D54CBDC2AA4D26D72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789956, "uuid": "d9e95f9c-6741-4ba8-8f63-cf993a174afd", "value": "96:591oGIj8oF4WEhFrKiYDVHFbBYXS5CGPh42UYJ/iR1Ka1Dtqp:Z6weBVBQip4JYNiqgtqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628789956, "uuid": "7bf3d4b3-0813-49af-93e6-f5ad882914ee", "value": 4970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628789956, "uuid": "8daab5aa-ed4c-4e7e-9b11-5ae21096fa9f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628789956, "uuid": "c30dd1c8-4871-40c3-bbe0-67ef9424abdd", "value": "layer1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fc6623-fb84-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628783181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628783181, "uuid": "66ee550d-8970-4a39-9635-dbde5d39d676", "comment": "Malware payload (njrat)", "value": "ca109387930ae116b991ddefe1cf05b4", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628783181, "uuid": "5d6a56fe-7b0c-4a74-9452-bb78ea2e2951", "comment": "Malware payload (njrat)", "value": "ffec1862f56857ad722abbcb98be7af86f2cf0763371bcb40273f0d884157c32", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628783181, "uuid": "23c3cb91-a77e-4e20-8d5c-1c1d5a691697", "comment": "Malware payload (njrat)", "value": "7c181bfdf72d21074c012a609ccd8035b56ef4d5", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628783181, "uuid": "2f042bf9-7fd4-4a42-af09-4a5ac3a25b15", "comment": "Malware payload (njrat)", "value": "9856502c6eee0a03994bd6db07c14aeb95905c2d61bb63558912d038ab869f3655b242d76080a53f8e7ebff4a9d23669", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628783181, "uuid": "11a9a728-e9d8-4ad8-9a3e-47a4103827c1", "value": "T130012800B541F1E3D10AF747DEF51379A6E776A48491E591206C869F00BB8AE3E83E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628783181, "uuid": "56ce46a0-1875-407b-aae8-72b6907f9bf2", "value": "12:dXVlTX7Fl9kQOGv9IXOKif+8irXWMMeRo8N5zliwqhP/jvVlg7:Tl7FeG9gOKXXLMeyMgV67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628783181, "uuid": "a04c5947-00d5-46b8-84d0-f9e049aee168", "value": 730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628783181, "uuid": "40acdc82-1d04-4e3a-bb2d-d1dab7fbf9c5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628783181, "uuid": "7d3d18c9-b8a3-4a2b-a846-21c064760b48", "value": "H6sj6c8Invoicereceipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }